4 files changed, 35 insertions, 5 deletions

diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 018fcdb353d2..281cf9cbb44c 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -174,6 +174,11 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state)
                 state->crtcs[i].state = NULL;
                 state->crtcs[i].old_state = NULL;
                 state->crtcs[i].new_state = NULL;
+
+                if (state->crtcs[i].commit) {
+                        drm_crtc_commit_put(state->crtcs[i].commit);
+                        state->crtcs[i].commit = NULL;
+                }
         }
 
         for (i = 0; i < config->num_total_plane; i++) {
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 80be74df7ba6..1bb4c318bdd4 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1408,15 +1408,16 @@ EXPORT_SYMBOL(drm_atomic_helper_wait_for_vblanks);
 void drm_atomic_helper_wait_for_flip_done(struct drm_device *dev,
                                           struct drm_atomic_state *old_state)
 {
-        struct drm_crtc_state *new_crtc_state;
         struct drm_crtc *crtc;
         int i;
 
-        for_each_new_crtc_in_state(old_state, crtc, new_crtc_state, i) {
-                struct drm_crtc_commit *commit = new_crtc_state->commit;
+        for (i = 0; i < dev->mode_config.num_crtc; i++) {
+                struct drm_crtc_commit *commit = old_state->crtcs[i].commit;
                 int ret;
 
-                if (!commit)
+                crtc = old_state->crtcs[i].ptr;
+
+                if (!crtc || !commit)
                         continue;
 
                 ret = wait_for_completion_timeout(&commit->flip_done, 10 * HZ);
@@ -1934,6 +1935,9 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state,
                 drm_crtc_commit_get(commit);
 
                 commit->abort_completion = true;
+
+                state->crtcs[i].commit = commit;
+                drm_crtc_commit_get(commit);
         }
 
         for_each_oldnew_connector_in_state(state, conn, old_conn_state, new_conn_state, i) {
diff --git a/drivers/gpu/drm/sun4i/sun4i_dotclock.c b/drivers/gpu/drm/sun4i/sun4i_dotclock.c
index e36004fbe453..2a15f2f9271e 100644
--- a/drivers/gpu/drm/sun4i/sun4i_dotclock.c
+++ b/drivers/gpu/drm/sun4i/sun4i_dotclock.c
@@ -81,9 +81,19 @@ static long sun4i_dclk_round_rate(struct clk_hw *hw, unsigned long rate,
         int i;
 
         for (i = tcon->dclk_min_div; i <= tcon->dclk_max_div; i++) {
-                unsigned long ideal = rate * i;
+                u64 ideal = (u64)rate * i;
                 unsigned long rounded;
 
+                /*
+                 * ideal has overflowed the max value that can be stored in an
+                 * unsigned long, and every clk operation we might do on a
+                 * truncated u64 value will give us incorrect results.
+                 * Let's just stop there since bigger dividers will result in
+                 * the same overflow issue.
+                 */
+                if (ideal > ULONG_MAX)
+                        goto out;
+
                 rounded = clk_hw_round_rate(clk_hw_get_parent(hw),
                                             ideal);
 
diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h
index da9d95a19580..1e713154f00e 100644
--- a/include/drm/drm_atomic.h
+++ b/include/drm/drm_atomic.h
@@ -153,6 +153,17 @@ struct __drm_planes_state {
 struct __drm_crtcs_state {
         struct drm_crtc *ptr;
         struct drm_crtc_state *state, *old_state, *new_state;
+
+        /**
+         * @commit:
+         *
+         * A reference to the CRTC commit object that is kept for use by
+         * drm_atomic_helper_wait_for_flip_done() after
+         * drm_atomic_helper_commit_hw_done() is called. This ensures that a
+         * concurrent commit won't free a commit object that is still in use.
+         */
+        struct drm_crtc_commit *commit;
+
         s32 __user *out_fence_ptr;
         u64 last_vblank_count;
 };