5 files changed, 22 insertions, 8 deletions

diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index c0530a1af5e3..2dc5e8bed172 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -461,6 +461,12 @@ int drm_mode_getfb(struct drm_device *dev,
         if (!fb)
                 return -ENOENT;
 
+        /* Multi-planar framebuffers need getfb2. */
+        if (fb->format->num_planes > 1) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         r->height = fb->height;
         r->width = fb->width;
         r->depth = fb->format->depth;
@@ -484,6 +490,7 @@ int drm_mode_getfb(struct drm_device *dev,
                 ret = -ENODEV;
         }
 
+out:
         drm_framebuffer_put(fb);
 
         return ret;
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index 4570da0227b4..d9a71f361b14 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -111,7 +111,7 @@ static int sun4i_drv_bind(struct device *dev)
         /* drm_vblank_init calls kcalloc, which can fail */
         ret = drm_vblank_init(drm, drm->mode_config.num_crtc);
         if (ret)
-                goto free_mem_region;
+                goto cleanup_mode_config;
 
         drm->irq_enabled = true;
 
@@ -139,7 +139,6 @@ finish_poll:
         sun4i_framebuffer_free(drm);
 cleanup_mode_config:
         drm_mode_config_cleanup(drm);
-free_mem_region:
         of_reserved_mem_device_release(dev);
 free_drm:
         drm_dev_unref(drm);
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index 500b6fb3e028..fa4bcd092eaf 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -538,7 +538,8 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
                                              &sun4i_hdmi_regmap_config);
         if (IS_ERR(hdmi->regmap)) {
                 dev_err(dev, "Couldn't create HDMI encoder regmap\n");
-                return PTR_ERR(hdmi->regmap);
+                ret = PTR_ERR(hdmi->regmap);
+                goto err_disable_mod_clk;
         }
 
         ret = sun4i_tmds_create(hdmi);
@@ -551,7 +552,8 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
                 hdmi->ddc_parent_clk = devm_clk_get(dev, "ddc");
                 if (IS_ERR(hdmi->ddc_parent_clk)) {
                         dev_err(dev, "Couldn't get the HDMI DDC clock\n");
-                        return PTR_ERR(hdmi->ddc_parent_clk);
+                        ret = PTR_ERR(hdmi->ddc_parent_clk);
+                        goto err_disable_mod_clk;
                 }
         } else {
                 hdmi->ddc_parent_clk = hdmi->tmds_clk;
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index 2de586b7c98b..a818ca491605 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -103,6 +103,7 @@ static void sun4i_tcon_channel_set_status(struct sun4i_tcon *tcon, int channel,
 
         if (enabled) {
                 clk_prepare_enable(clk);
+                clk_rate_exclusive_get(clk);
         } else {
                 clk_rate_exclusive_put(clk);
                 clk_disable_unprepare(clk);
@@ -262,7 +263,7 @@ static void sun4i_tcon0_mode_set_common(struct sun4i_tcon *tcon,
                                         const struct drm_display_mode *mode)
 {
         /* Configure the dot clock */
-        clk_set_rate_exclusive(tcon->dclk, mode->crtc_clock * 1000);
+        clk_set_rate(tcon->dclk, mode->crtc_clock * 1000);
 
         /* Set the resolution */
         regmap_write(tcon->regs, SUN4I_TCON0_BASIC0_REG,
@@ -423,7 +424,7 @@ static void sun4i_tcon1_mode_set(struct sun4i_tcon *tcon,
         WARN_ON(!tcon->quirks->has_channel_1);
 
         /* Configure the dot clock */
-        clk_set_rate_exclusive(tcon->sclk1, mode->crtc_clock * 1000);
+        clk_set_rate(tcon->sclk1, mode->crtc_clock * 1000);
 
         /* Adjust clock delay */
         clk_delay = sun4i_tcon_get_clk_delay(mode, 1);
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index b5b335c9b2bb..2ebdc6d5a76e 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -159,10 +159,15 @@ static int udl_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
 {
         unsigned long start = vma->vm_start;
         unsigned long size = vma->vm_end - vma->vm_start;
-        unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
+        unsigned long offset;
         unsigned long page, pos;
 
-        if (offset + size > info->fix.smem_len)
+        if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+                return -EINVAL;
+
+        offset = vma->vm_pgoff << PAGE_SHIFT;
+
+        if (offset > info->fix.smem_len || size > info->fix.smem_len - offset)
                 return -EINVAL;
 
         pos = (unsigned long)info->fix.smem_start + offset;