Merge branch 'drm-fixes-3.8' of git://people.freedesktop.org/~agd5f/linux into drm-next

Fixes for UMS mode which has been broken for a while plus an rn50 fix
and a dma fix.

* 'drm-fixes-3.8' of git://people.freedesktop.org/~agd5f/linux:
  radeon/kms: fix dma relocation checking
  radeon/kms: force rn50 chip to always report connected on analog output
  drm/radeon: fix error path in kpage allocation
  drm/radeon: fix a bogus kfree
  drm/radeon: fix NULL pointer dereference in UMS mode

3 files changed, 20 insertions, 9 deletions

diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 03191a56eb4..69ec24ab8d6 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -2476,8 +2476,10 @@ static void r600_cs_parser_fini(struct radeon_cs_parser *parser, int error)
         kfree(parser->relocs);
         for (i = 0; i < parser->nchunks; i++) {
                 kfree(parser->chunks[i].kdata);
-                kfree(parser->chunks[i].kpage[0]);
-                kfree(parser->chunks[i].kpage[1]);
+                if (parser->rdev && (parser->rdev->flags & RADEON_IS_AGP)) {
+                        kfree(parser->chunks[i].kpage[0]);
+                        kfree(parser->chunks[i].kpage[1]);
+                }
         }
         kfree(parser->chunks);
         kfree(parser->chunks_array);
@@ -2561,16 +2563,16 @@ int r600_dma_cs_next_reloc(struct radeon_cs_parser *p,
         struct radeon_cs_chunk *relocs_chunk;
         unsigned idx;
 
+        *cs_reloc = NULL;
         if (p->chunk_relocs_idx == -1) {
                 DRM_ERROR("No relocation chunk !\n");
                 return -EINVAL;
         }
-        *cs_reloc = NULL;
         relocs_chunk = &p->chunks[p->chunk_relocs_idx];
         idx = p->dma_reloc_idx;
-        if (idx >= relocs_chunk->length_dw) {
+        if (idx >= p->nrelocs) {
                 DRM_ERROR("Relocs at %d after relocations chunk end %d !\n",
-                          idx, relocs_chunk->length_dw);
+                          idx, p->nrelocs);
                 return -EINVAL;
         }
         *cs_reloc = p->relocs_ptr[idx];
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 396baba0141..469661fd190 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -279,13 +279,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
                                   p->chunks[p->chunk_ib_idx].length_dw);
                         return -EINVAL;
                 }
-                if ((p->rdev->flags & RADEON_IS_AGP)) {
+                if (p->rdev && (p->rdev->flags & RADEON_IS_AGP)) {
                         p->chunks[p->chunk_ib_idx].kpage[0] = kmalloc(PAGE_SIZE, GFP_KERNEL);
                         p->chunks[p->chunk_ib_idx].kpage[1] = kmalloc(PAGE_SIZE, GFP_KERNEL);
                         if (p->chunks[p->chunk_ib_idx].kpage[0] == NULL ||
                             p->chunks[p->chunk_ib_idx].kpage[1] == NULL) {
-                                kfree(p->chunks[i].kpage[0]);
-                                kfree(p->chunks[i].kpage[1]);
+                                kfree(p->chunks[p->chunk_ib_idx].kpage[0]);
+                                kfree(p->chunks[p->chunk_ib_idx].kpage[1]);
                                 return -ENOMEM;
                         }
                 }
@@ -583,7 +583,8 @@ static int radeon_cs_update_pages(struct radeon_cs_parser *p, int pg_idx)
         struct radeon_cs_chunk *ibc = &p->chunks[p->chunk_ib_idx];
         int i;
         int size = PAGE_SIZE;
-        bool copy1 = (p->rdev->flags & RADEON_IS_AGP) ? false : true;
+        bool copy1 = (p->rdev && (p->rdev->flags & RADEON_IS_AGP)) ?
+                false : true;
 
         for (i = ibc->last_copied_page + 1; i < pg_idx; i++) {
                 if (DRM_COPY_FROM_USER(p->ib.ptr + (i * (PAGE_SIZE/4)),
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index f5ba2241dac..62cd512f5c8 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -640,6 +640,14 @@ static enum drm_connector_status radeon_legacy_primary_dac_detect(struct drm_enc
         enum drm_connector_status found = connector_status_disconnected;
         bool color = true;
 
+        /* just don't bother on RN50 those chip are often connected to remoting
+         * console hw and often we get failure to load detect those. So to make
+         * everyone happy report the encoder as always connected.
+         */
+        if (ASIC_IS_RN50(rdev)) {
+                return connector_status_connected;
+        }
+
         /* save the regs we need */
         vclk_ecp_cntl = RREG32_PLL(RADEON_VCLK_ECP_CNTL);
         crtc_ext_cntl = RREG32(RADEON_CRTC_EXT_CNTL);