Merge branch 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

* 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  agp: zero pages before sending to userspace
  drm: check for minor master before allowing drop master.
  drm: set/clear is_master when master changed
  drm: clean dirty memory after device release
  drm: count reaches -1

4 files changed, 20 insertions, 8 deletions

diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 10d6cbd7c05e..2224b762b7fb 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -1226,7 +1226,7 @@ int agp_generic_alloc_pages(struct agp_bridge_data *bridge, struct agp_memory *m
         int i, ret = -ENOMEM;
 
         for (i = 0; i < num_pages; i++) {
-                page = alloc_page(GFP_KERNEL | GFP_DMA32);
+                page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
                 /* agp_free_memory() needs gart address */
                 if (page == NULL)
                         goto out;
@@ -1257,7 +1257,7 @@ void *agp_generic_alloc_page(struct agp_bridge_data *bridge)
 {
         struct page * page;
 
-        page = alloc_page(GFP_KERNEL | GFP_DMA32);
+        page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
         if (page == NULL)
                 return NULL;
 
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index d009661781bc..ef878615c49f 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -159,6 +159,9 @@ void drm_master_put(struct drm_master **master)
 int drm_setmaster_ioctl(struct drm_device *dev, void *data,
                         struct drm_file *file_priv)
 {
+        if (file_priv->is_master)
+                return 0;
+
         if (file_priv->minor->master && file_priv->minor->master != file_priv->master)
                 return -EINVAL;
 
@@ -169,6 +172,7 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
             file_priv->minor->master != file_priv->master) {
                 mutex_lock(&dev->struct_mutex);
                 file_priv->minor->master = drm_master_get(file_priv->master);
+                file_priv->is_master = 1;
                 mutex_unlock(&dev->struct_mutex);
         }
 
@@ -178,10 +182,15 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
 int drm_dropmaster_ioctl(struct drm_device *dev, void *data,
                          struct drm_file *file_priv)
 {
-        if (!file_priv->master)
+        if (!file_priv->is_master)
                 return -EINVAL;
+
+        if (!file_priv->minor->master)
+                return -EINVAL;
+
         mutex_lock(&dev->struct_mutex);
         drm_master_put(&file_priv->minor->master);
+        file_priv->is_master = 0;
         mutex_unlock(&dev->struct_mutex);
         return 0;
 }
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index bc0c6849360c..022876ae34f0 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -132,6 +132,7 @@ void drm_sysfs_destroy(void)
  */
 static void drm_sysfs_device_release(struct device *dev)
 {
+        memset(dev, 0, sizeof(struct device));
         return;
 }
 
diff --git a/drivers/gpu/drm/via/via_dma.c b/drivers/gpu/drm/via/via_dma.c
index 7a339dba6a69..bfb92d283260 100644
--- a/drivers/gpu/drm/via/via_dma.c
+++ b/drivers/gpu/drm/via/via_dma.c
@@ -481,11 +481,13 @@ static int via_wait_idle(drm_via_private_t * dev_priv)
 {
         int count = 10000000;
 
-        while (!(VIA_READ(VIA_REG_STATUS) & VIA_VR_QUEUE_BUSY) && count--);
+        while (!(VIA_READ(VIA_REG_STATUS) & VIA_VR_QUEUE_BUSY) && --count)
+                ;
 
-        while (count-- && (VIA_READ(VIA_REG_STATUS) &
+        while (count && (VIA_READ(VIA_REG_STATUS) &
                            (VIA_CMD_RGTR_BUSY | VIA_2D_ENG_BUSY |
-                            VIA_3D_ENG_BUSY))) ;
+                            VIA_3D_ENG_BUSY)))
+                --count;
         return count;
 }
 
@@ -705,7 +707,7 @@ static int via_cmdbuf_size(struct drm_device *dev, void *data, struct drm_file *
         switch (d_siz->func) {
         case VIA_CMDBUF_SPACE:
                 while (((tmp_size = via_cmdbuf_space(dev_priv)) < d_siz->size)
-                       && count--) {
+                       && --count) {
                         if (!d_siz->wait) {
                                 break;
                         }
@@ -717,7 +719,7 @@ static int via_cmdbuf_size(struct drm_device *dev, void *data, struct drm_file *
                 break;
         case VIA_CMDBUF_LAG:
                 while (((tmp_size = via_cmdbuf_lag(dev_priv)) > d_siz->size)
-                       && count--) {
+                       && --count) {
                         if (!d_siz->wait) {
                                 break;
                         }