Merge tag 'v3.2-rc6' of /home/airlied/devel/kernel/linux-2.6 into drm-core-next

Merge in the upstream tree to bring in the mainline fixes.

Conflicts:
	drivers/gpu/drm/exynos/exynos_drm_fbdev.c
	drivers/gpu/drm/nouveau/nouveau_sgdma.c

2 files changed, 19 insertions, 10 deletions

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index 3f6343502d1f..5ff561d4e0b4 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -140,7 +140,7 @@ int vmw_present_ioctl(struct drm_device *dev, void *data,
                 goto out_clips;
         }
 
-        clips = kzalloc(num_clips * sizeof(*clips), GFP_KERNEL);
+        clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
         if (clips == NULL) {
                 DRM_ERROR("Failed to allocate clip rect list.\n");
                 ret = -ENOMEM;
@@ -232,7 +232,7 @@ int vmw_present_readback_ioctl(struct drm_device *dev, void *data,
                 goto out_clips;
         }
 
-        clips = kzalloc(num_clips * sizeof(*clips), GFP_KERNEL);
+        clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
         if (clips == NULL) {
                 DRM_ERROR("Failed to allocate clip rect list.\n");
                 ret = -ENOMEM;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 0585987f2945..1748a7142aca 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -105,6 +105,10 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
         struct vmw_dma_buffer *dmabuf = NULL;
         int ret;
 
+        /* A lot of the code assumes this */
+        if (handle && (width != 64 || height != 64))
+                return -EINVAL;
+
         if (handle) {
                 ret = vmw_user_surface_lookup_handle(dev_priv, tfile,
                                                      handle, &surface);
@@ -410,8 +414,9 @@ static int do_surface_dirty_sou(struct vmw_private *dev_priv,
         top = clips->y1;
         bottom = clips->y2;
 
-        clips_ptr = clips;
-        for (i = 1; i < num_clips; i++, clips_ptr += inc) {
+        /* skip the first clip rect */
+        for (i = 1, clips_ptr = clips + inc;
+             i < num_clips; i++, clips_ptr += inc) {
                 left = min_t(int, left, (int)clips_ptr->x1);
                 right = max_t(int, right, (int)clips_ptr->x2);
                 top = min_t(int, top, (int)clips_ptr->y1);
@@ -1331,7 +1336,10 @@ int vmw_kms_close(struct vmw_private *dev_priv)
          * drm_encoder_cleanup which takes the lock we deadlock.
          */
         drm_mode_config_cleanup(dev_priv->dev);
-        vmw_kms_close_legacy_display_system(dev_priv);
+        if (dev_priv->sou_priv)
+                vmw_kms_close_screen_object_display(dev_priv);
+        else
+                vmw_kms_close_legacy_display_system(dev_priv);
         return 0;
 }
 
@@ -1809,7 +1817,8 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
         }
 
         rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
-        rects = kzalloc(rects_size, GFP_KERNEL);
+        rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
+                        GFP_KERNEL);
         if (unlikely(!rects)) {
                 ret = -ENOMEM;
                 goto out_unlock;
@@ -1824,10 +1833,10 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
         }
 
         for (i = 0; i < arg->num_outputs; ++i) {
-                if (rects->x < 0 ||
-                    rects->y < 0 ||
-                    rects->x + rects->w > mode_config->max_width ||
-                    rects->y + rects->h > mode_config->max_height) {
+                if (rects[i].x < 0 ||
+                    rects[i].y < 0 ||
+                    rects[i].x + rects[i].w > mode_config->max_width ||
+                    rects[i].y + rects[i].h > mode_config->max_height) {
                         DRM_ERROR("Invalid GUI layout.\n");
                         ret = -EINVAL;
                         goto out_free;