Merge tag 'drm-misc-fixes-2018-05-16' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

- core: Fix regression in dev node offsets (Haneen)
- vc4: Fix memory leak on driver close (Eric)
- dumb-buffers: Prevent overflow in DIV_ROUND_UP() (Dan)

Cc: Haneen Mohammed <hamohammed.sa@gmail.com>
Cc: Eric Anholt <eric@anholt.net>
Cc: Dan Carpenter <dan.carpenter@oracle.com>

* tag 'drm-misc-fixes-2018-05-16' of git://anongit.freedesktop.org/drm/drm-misc:
  drm/dumb-buffers: Integer overflow in drm_mode_create_ioctl()
  drm/vc4: Fix leak of the file_priv that stored the perfmon.
  drm: Match sysfs name in link removal to link creation

3 files changed, 6 insertions, 4 deletions

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index a1b9338736e3..c2c21d839727 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -716,7 +716,7 @@ static void remove_compat_control_link(struct drm_device *dev)
         if (!minor)
                 return;
 
-        name = kasprintf(GFP_KERNEL, "controlD%d", minor->index);
+        name = kasprintf(GFP_KERNEL, "controlD%d", minor->index + 64);
         if (!name)
                 return;
 
diff --git a/drivers/gpu/drm/drm_dumb_buffers.c b/drivers/gpu/drm/drm_dumb_buffers.c
index 39ac15ce4702..9e2ae02f31e0 100644
--- a/drivers/gpu/drm/drm_dumb_buffers.c
+++ b/drivers/gpu/drm/drm_dumb_buffers.c
@@ -65,12 +65,13 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev,
                 return -EINVAL;
 
         /* overflow checks for 32bit size calculations */
-        /* NOTE: DIV_ROUND_UP() can overflow */
+        if (args->bpp > U32_MAX - 8)
+                return -EINVAL;
         cpp = DIV_ROUND_UP(args->bpp, 8);
-        if (!cpp || cpp > 0xffffffffU / args->width)
+        if (cpp > U32_MAX / args->width)
                 return -EINVAL;
         stride = cpp * args->width;
-        if (args->height > 0xffffffffU / stride)
+        if (args->height > U32_MAX / stride)
                 return -EINVAL;
 
         /* test for wrap-around */
diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 94b99c90425a..7c95ed5c5cac 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -130,6 +130,7 @@ static void vc4_close(struct drm_device *dev, struct drm_file *file)
         struct vc4_file *vc4file = file->driver_priv;
 
         vc4_perfmon_close_file(vc4file);
+        kfree(vc4file);
 }
 
 static const struct vm_operations_struct vc4_vm_ops = {