Add OPP table and interconnects property to scale DDR frequency with
CPU frequency for better performance. Each operating point entry of
the OPP table has CPU freq to per MC channel bandwidth mapping.
One table is added for each cluster even though the table data is
same because the bandwidth request is per cluster. This is done
because the OPP framework creates a single icc path and hence single
bandwidth request if the table is marked as 'opp-shared' and shared
among all clusters. For us, the OPP table data is same but the MC
Client ID argument to interconnects property is different for each
cluster. So, having per cluster tables makes different icc paths for
each cluster and helps to make per cluster BW requests.
Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
Add OPP table and interconnects property to scale DDR frequency with
CPU frequency for better performance. Each operating point entry of
the OPP table has CPU freq to per MC channel bandwidth mapping. One
table is added for each cluster because the different cpu types have
different scaling curves.
Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
Add Interconnect framework support to dynamically set the DRAM
bandwidth from different clients. The MC driver is added as an ICC
provider and the EMC driver is already a provider.
Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
Add Interconnect framework support to dynamically set the DRAM
bandwidth from different clients. The MC driver is added as an ICC
provider and the EMC driver is already a provider.
Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
This adds support for dynamic frequency scaling of external memory on
devices with bpmp firmware that does not support bwmgr.
Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
This will be used in the upcoming non-bpmp icc support, which will use
the common tegra emc rate support which uses the opp framework.
Change-Id: If4a3efaae0ad06de029ffd34c2b11faea5044d58
Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
These are being referenced by actmon, but are not currently enabled.
Fixes: 654427e0b9 ("arm64: tegra: Add OPP tables on Tegra210")
Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
As is, the EMC drivers for each 32-bit platform contain almost
identical duplicated code for aggregating rate requests. Move this
code out to a shared tegra-emc-common file to reduce duplication,
and add kerneldoc comments.
Based on code from the tegra20-emc driver.
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Link: https://patch.msgid.link/20260501-memory-refactor-v3-1-69fb1ae1a7ca@nvidia.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Without the cmu, nvdisplay will display colors that are notably darker
than intended. The vendor bootloader and the downstream display driver
enable the cmu and sets a sRGB table. Loading that table here results in
the intended colors.
Co-developed-by: Kurt Kiefer <kekiefer@gmail.com>
Signed-off-by: Kurt Kiefer <kekiefer@gmail.com>
Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
Tested-by: Jasper Korten <jja2000@gmail.com>
The member list of struct binder_priority is missing the colon kernel-doc
needs to associate a line with a member, so neither @sched_policy nor @prio
is picked up as a description.
This has been wrong since the block was introduced together with the struct
in "ANDROID: binder: add support for RT prio inheritance." That commit was
merged on experimental/android-4.19-staging and the block has been carried
forward across branches since, so there is no commit in android-mainline
history to point a Fixes: tag at. The same commit spelled @sched_policy:
correctly in the binder_node block just above, which suggests the missing
colons here were a typo rather than a convention.
struct binder_priority is ANDROID-only and does not exist upstream, so there
is nothing to send to mainline for this.
scripts/kernel-doc -none drivers/android/binder_internal.h reports two
warnings for binder_priority before this change and none after it. The
remaining warnings in this file are also present in mainline and are left
alone here.
No functional change.
Change-Id: Id475f34170682b465e270a0ffa359f8bbd1b641f
Signed-off-by: Hung-Chun Tseng <alan.tseng.cs@gmail.com>
dma_heap_find(), dma_heap_buffer_alloc() and dma_heap_bufferfd_alloc() all
have a documented parameter list but no Return: section, so kernel-doc has
nothing to say about what a caller gets back.
Documentation/doc-guide/kernel-doc.rst asks for a Return: section on
functions that return a value, and scripts/kernel-doc -none -Wall
include/linux/dma-heap.h reports three "No description found for return
value" warnings before this change and none after it. The default warning
level is unaffected: the file is clean there both before and after.
The wording follows what the implementations in drivers/dma-buf/dma-heap.c
actually do:
dma_heap_find() returns the heap, or NULL when the name is not
registered
dma_heap_buffer_alloc() returns a dma_buf, or an ERR_PTR() on failure
dma_heap_bufferfd_alloc() returns an fd, or a negative errno on failure
All three helpers are ANDROID-only and do not exist upstream, so there is
nothing to send to mainline for this.
No functional change.
Change-Id: I9b8aa342cdda421af018171ec96f1257d8dbd5bc
Signed-off-by: Hung-Chun Tseng <alan.tseng.cs@gmail.com>
dump_tasks() can be called from NMI context to dump memory status of all
tasks. However, calling from NMI context has safety issues:
1. find_lock_task_mm() acquires task_lock(t) using spin_lock(), which
is not NMI-safe and can deadlock if alloc_lock is held when NMI fires.
2. mem_cgroup_scan_tasks() traverses memcg structures and takes locks
that are not NMI-safe.
Fix these by:
- Using spin_trylock(&t->alloc_lock) in find_lock_task_mm() when in_nmi().
- Returning early if a memcg oom dump is requested in NMI context.
Fixes: 4df28ddcd9 ("ANDROID: mm: export dump_tasks symbol.")
Bug: 538262381
Change-Id: I8b79213015fde74b81427d44f122296c5e0edaf9
Signed-off-by: Mayank Rungta <mrungta@google.com>
MTK_TIMER is selected by ARCH_MEDIATEK. The commit enables
it in order to not alter the core when we enable
CONFIG_ARCH_MEDIATEK in vendor fragment.
It is also not directly settable due to visibility
condition "if COMPILE_TEST" not met thus selecting
it as a hidden config.
The GKI_HIDDEN_MTK_CONFIGS is enabled if ARM64 since
it is only applicable to Mediatek devices.
Bug: 432487220
Bug: 532940853
Bug: 545953895
Change-Id: Iac562e539063a59f3988e87a151251eb7554f964
Signed-off-by: Zyta Szpak <zyta@google.com>
(cherry picked from commit a79d348482)
(cherry picked from commit bcb75c47c8566960be30d9c3cf14f8b5bbf4d49a)
Currently, __alloc_contig_verify_gfp_mask() rejects __GFP_NORETRY because
it is not in the allowed action_mask. This causes cma_alloc() calls that
pass __GFP_NORETRY to fail immediately during mask verification in
alloc_contig_range().
Support __GFP_NORETRY by adding it to the allowed action_mask and
cc_action_mask. Furthermore, adjust the construction of gfp_cc_mask
so that if the caller explicitly requested __GFP_NORETRY, we respect
it and do not force __GFP_RETRY_MAYFAIL, avoiding conflicting retry
directives for the underlying migration/compaction.
This allows cma_alloc() with __GFP_NORETRY to fail quickly when the
range cannot be allocated, rather than retrying heavily or failing
immediately due to invalid GFP flags.
Bug: 519847597
Test: Local build and flash verification
Change-Id: I1bee0b838ac957d08a24358d100d20b8ef7babeb
Signed-off-by: Minchan Kim <minchan@google.com>
Signed-off-by: Henry Dong <donghenry@google.com>
In q2_get_counter(), a new counter entry is added to counter_list
and counter_list_lock is released before proc_create_data() is
invoked. During this window, another thread can locate the counter
in counter_list and increment its reference count via
atomic_inc(&e->ref).
If proc_create_data() subsequently fails, the error handling path
previously called list_del() and kfree() unconditionally, ignoring
the refcount. If another thread acquired a reference in the interim,
this resulted in a Use-After-Free (UAF) condition.
Fix this by using atomic_dec_and_test(&e->ref) under
counter_list_lock when proc_create_data() fails. Only remove from
counter_list and free the memory if the refcount reaches zero. If
another thread holds a reference, set procfs_entry to NULL and
leave the counter intact for the surviving thread.
Fixes: 2e134f75ce91 ("ANDROID: netfilter: xt_quota2: add quota2 from xtables-addons")
Bug: 499166786
Change-Id: I1270d6d94ec0bd6a83858ad053434dae0393b7e3
Signed-off-by: Todd Kjos <tkjos@google.com>
favordynmods prioritizes cgroup writes over reads. Before commit
0568f89d4f ("cgroup: replace global percpu_rwsem with per threadgroup
resem when writing to cgroup.procs") first introduced in the 6.18
kernel, this effectively meant replacing the percpu_rwsem fast path with
a global lock (percpu_rwsem slowpath) for readers to allow speeding up
writers. This forced all fork()s and exit()s globally down the slow
path. After commit 0568f89d4f that is no longer the case, and the
write side of the lock is much more narrow at per-threadgroup scope
instead of global, drastically reducing contention.
So we want to use favordynmods only on kernels that have commit
0568f89d4f. A runtime check for the presence of commit 0568f89d4f is
possible, but awkward and potentially slow depending on how it's done. A
better alternative is to simply enable CONFIG_CGROUP_FAVOR_DYNMODS on
kernels where we know commit 0568f89d4f is present.
Bug: 543503146
Change-Id: I511223793adeab7263635895a467a15258086a23
Signed-off-by: T.J. Mercier <tjmercier@google.com>
With recent patches to Kernel, open-dice supports ACPI device
configuration, this CL flips the flag for enabling it.
Bug: 510177847
Test: build
Change-Id: If9db8e6084883eae2c25370aafeadb624485c5bd
Signed-off-by: Song Guo <songguo@google.com>
OpenDICE can also used on x86 platforms for attestation, one of the
usecase is Android's protected VM.
The OpenDICE device driver only supports device tree, adding ACPI
support so it can also be used on x86 environments easily.
The patch is verified using crosvm, with the following ACPI table passed
using --acpi-table, with --file-backed-mapping for the corresponding
memory region.
DefinitionBlock (
"opendice.aml", "SSDT", 2, "GOOGLE", "OpenDICE", 0x00000001
)
{
Scope (\_SB)
{
Device (DICE)
{
Name (_HID, "PRP0001")
Name (_DSD, Package () {
ToUUID ("daffd814-6eba-4d8c-8a91-bc9bbf4aa301"),
Package () {
Package () {
"compatible",
Package () { "google,open-dice" }
}
}
})
Name (_CRS, ResourceTemplate () {
Memory32Fixed (ReadOnly, 0x9D1C3000, 0x00001000)
})
}
}
}
Signed-off-by: Song Guo <songguo@google.com>
Link: https://patch.msgid.link/20260715122146.4069884-4-songguo@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 510177847
Change-Id: Ib66a6392e166840b3459918db5e5d5c9fefe2546
(cherry picked from commit deda667260ae495f5edc68d56e229dbfbf732243 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-next)
This config was removed in commit 6e36be511d ("crypto: arm64/sha256 -
implement library instead of shash") and is now obsolete, so drop it
from our microdroid_defconfig. CONFIG_CRYPTO_SHA2_ARM64_CE is now
subsumed by CONFIG_CRYPTO_SHA256 so enable CONFIG_CRYPTO_SHA256.
Bug: 489728064
Change-Id: Ia8fb63931e1c8a6bf7e49d0a8417a6461787d595
Signed-off-by: David Anderson <dvander@google.com>
Signed-off-by: Gokul Krishnakumar <gokul.krishnakumar@oss.qualcomm.com>
commit d5e79eeba3 ("dma-buf: heaps: Deduplicate docs and adopt common
format") fixed the struct dma_heap member list upstream by adding the
colon kernel-doc needs to @heap_devt, @list and @heap_cdev.
That hunk is missing from android-mainline. The drm-next merge cited
below resolved this block by taking the new @priv: line from mainline
while keeping the android side's colonless @heap_devt / @list /
@heap_cdev, next to the ANDROID-only @heap_dev.
Restore the upstream wording, give the ANDROID-only @heap_dev the same
treatment, and document @refcount, which was added later with the heap
device lifetime handling and was never described.
drm-misc-next is clean here, so there is nothing to send upstream for
this.
scripts/kernel-doc -none drivers/dma-buf/dma-heap.c reports five
warnings before this change and none after it.
No functional change.
Fixes: da0c10aefa ("Merge de848da12f ("Merge tag 'drm-next-2024-09-19' of https://gitlab.freedesktop.org/drm/kernel") into android-mainline")
Change-Id: Ic073f95624280d52f6ae39f58768acefd1809f77
Signed-off-by: Hung-Chun Tseng <alan.tseng.cs@gmail.com>
selinux_inode_init_security() marks the isec as initialized before
checking if mount labeling is supported (SBLABEL_MNT). This was fine
until commit 9722955b54 ("bpf: Add simple xattr support to bpffs"),
where genfscon bpffs mounts fail the SBLABEL_MNT check as expected (no
xattrs) and yet leave the isec->initialized. This breaks subsequent
calls to inode_doinit_with_dentry().
Do the SBLABEL_MNT check before the inode security is initialized.
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/all/akWdcp6P0FkNDzBk@google.com/
Fixes: 9722955b54 ("bpf: Add simple xattr support to bpffs")
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Bug: 529733987
(cherry picked from commit 28254722a459938d97150d3b0712b81e06d0645e
https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git stable-7.2)
Change-Id: I291f198d144dda69f7ea0346b01d5fb48eb9abbe
Signed-off-by: Carlos Llamas <cmllamas@google.com>
This reverts commit a54061ac8f.
The revert causes merge conflicts with further upstream patches. Let's
bring back the missing patch and instead land a forward-fix to be sent
upstream.
Bug: 529733987
Change-Id: I6578709a4ee9e9b62990f80b8cff120549a86c24
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Lockdep reports recursive locking warnings in `incfs_setattr` and
`iterate_dir`. Because IncFS is a stacked filesystem, these operations
re-enter VFS on the backing (lower) directory or file, calling
VFS helpers or locking the lower inode directly.
Since VFS acquires the upper inode's `i_rwsem` with subclass 0, the
unannotated re-entry into the lower inode (which also uses subclass 0)
falsely triggers lockdep's recursive lock detection.
Fix this by annotating the lower inode acquisitions with the
`I_MUTEX_PARENT` subclass:
1. In `incfs_setattr`, use `inode_lock_nested(..., I_MUTEX_PARENT)`
consistently with all other directory operations in this file.
2. In `iterate_incfs_dir`, temporarily set the backing inode's
lock class subclass to `I_MUTEX_PARENT` around the `iterate_dir()`
VFS helper call, and restore it to 0 immediately afterwards.
Bug: 419203261
Bug: 419264069
Change-Id: I0447aa79f91576b67290eadf143acfb87d8cb9b4
Signed-off-by: Howard Chen <howardsoc@google.com>
Remove the requirement for the wireless regulation database to be
signed. The database is loaded from a dm-verity read-only partition,
there is no need for an extra signature verification.
This change reduces the number of dependencies on X509 and PKCS#7
parsers.
Bug: 537090642
Bug: 517291991
Change-Id: Ic8a262bf0513c2c4c2439a46877b614ea226aca7
Signed-off-by: Thiébaud Weksteen <tweek@google.com>
The sysfs_remove_file() call in idletimer_tg_destroy() was incorrectly
placed before cancel_work_sync() during a merge conflict resolution in
commit 92cf99250d ("Merge tag 'v6.2-rc1' into android-mainline").
Let's switch to the original order as introduced by commit 68983a354a
("netfilter: xtables: Add snapshot of hardidletimer target"). This
aligns the order of the calls with upstream.
Also move unregister_pm_notifier() calls before timer_shutdown_sync().
This aligns the order of the calls with older ACK branches. As having
these differences across branches is creating confusion with partners.
Bug: 497588852
Bug: 531493108
Fixes: 92cf99250d ("Merge tag 'v6.2-rc1' into android-mainline")
Change-Id: Ia65db132c22a487b1874e9b59da8e7c9ad3ac324
Signed-off-by: Carlos Llamas <cmllamas@google.com>
strset_add_str_mem() might reallocate the strset data buffer in order to
accommodate the provided string 's'. However, if 's' points to a string
already present in the buffer, it becomes dangling after the realloc.
This leads to a use-after-free when attempting to memcpy() the string
into the new buffer.
One scenario that triggers this problematic path is when resolve_btfids
attempts to patch kfunc prototypes using existing BTF parameter names:
| resolve_btfids: function bpf_list_push_back_impl already exists in BTF
| Segmentation fault (core dumped)
Compiling resolve_btfids with fsanitize=address generates a detailed
report of the UAF:
| =================================================================
| ERROR: AddressSanitizer: heap-use-after-free on address 0x7f4c4a500bd4
| ==1507892==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f4c4a500bd4 at pc 0x55d25155a2a8 bp 0x7ffcef879060 sp 0x7ffcef878818
| READ of size 5 at 0x7f4c4a500bd4 thread T0
| #0 0x55d25155a2a7 in memcpy (tools/bpf/resolve_btfids/resolve_btfids+0xcf2a7)
| #1 0x55d2515d708e in strset__add_str tools/lib/bpf/strset.c:162:2
| #2 0x55d2515c730b in btf__add_str tools/lib/bpf/btf.c:2109:8
| #3 0x55d2515c9020 in btf__add_func_param tools/lib/bpf/btf.c:3108:14
| #4 0x55d25159f0b5 in process_kfunc_with_implicit_args tools/bpf/resolve_btfids/main.c:1196:9
| #5 0x55d25159e004 in btf2btf tools/bpf/resolve_btfids/main.c:1229:9
| #6 0x55d25159cee7 in main tools/bpf/resolve_btfids/main.c:1535:6
| #7 0x7f4c78e29f76 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
| #8 0x7f4c78e2a026 in __libc_start_main csu/../csu/libc-start.c:360:3
| #9 0x55d2514bb860 in _start (tools/bpf/resolve_btfids/resolve_btfids+0x30860)
|
| 0x7f4c4a500bd4 is located 13268 bytes inside of 2829000-byte region [0x7f4c4a4fd800,0x7f4c4a7b02c8)
| freed by thread T0 here:
| #0 0x55d25155b700 in realloc (tools/bpf/resolve_btfids/resolve_btfids+0xd0700)
| #1 0x55d2515c426c in libbpf_reallocarray tools/lib/bpf/./libbpf_internal.h:220:9
| #2 0x55d2515c426c in libbpf_add_mem tools/lib/bpf/btf.c:224:13
|
| previously allocated by thread T0 here:
| #0 0x55d25155b2e3 in malloc (tools/bpf/resolve_btfids/resolve_btfids+0xd02e3)
| #1 0x55d2515d6e7d in strset__new tools/lib/bpf/strset.c:58:20
While resolve_btfids could be refactored to avoid this call path, let's
instead fix this issue at the source in strset__add_str() and avoid
similar scenarios.
Let's check if set->strs_data was reallocated and whether 's' points to
an internal string within the old strset buffer. In such case, 's' is
reconstructed to point to the new buffer.
While already here, also fix strset__find_str() which suffers from the
same problem by factoring out the common operations into a new helper
function strset_str_append().
Fixes: 90d76d3ece ("libbpf: Extract internal set-of-strings datastructure APIs")
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Suggested-by: Mykyta Yatsenko <yatsenko@meta.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260523162722.2718940-1-cmllamas@google.com
Bug: 512529051
(cherry picked from commit b23705e6afb6ac4ae6d220dcb35975698667dd76)
Change-Id: I424a1d896df5134fa4abc7a0fff4c46c0c966a98
Signed-off-by: Carlos Llamas <cmllamas@google.com>
This reverts commit 6c59ee8c14.
A newer version of this fix has landed as commit b23705e6afb6 ("libbpf:
Fix UAF in strset__add_str()") upstream. Let's switch to that instead.
Bug: 512529051
Change-Id: I732cdac57e8a7bd7272e048296fca570944e9930
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Upstream added a new backtrace-suppression kunit test module that builds
by default with CONFIG_KUNIT_TEST, so add it to the list of kunit common
modules.
Fixes: bbc960d009 ("kunit: Add backtrace suppression self-tests")
Change-Id: I954b297b363b229d7458aabb553077df5cfbe28b
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Steps on the way to v7.2-rc1
Resolves trivial merge conflicts in:
drivers/md/Kconfig
drivers/md/Makefile
Cc: Eric Biggers <ebiggers@google.com>
Change-Id: Ibbfe7df1bd9a979e5a6fe9cf1295229fe6046afa
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Steps on the way to v7.2-rc1
Resolves trivial merge conflicts in:
kernel/sched/fair.c
kernel/sched/sched.h
Cc: John Stultz <jstultz@google.com>
Change-Id: I49b142eba0e69f4a41425dae76f298c25c07dc68
Signed-off-by: Carlos Llamas <cmllamas@google.com>
This reverts commit e1061a9371.
Upstream refactored util_est_update() in commit 6d2051403d
("sched/fair: Update util_est after updating util_avg during dequeue")
and this vendor hook needs to be refactored accordingly. Remove it now
but it can reland after the updates if really needed.
Bug: 170508405
Cc: Rick Yiu <rickyiu@google.com>
Change-Id: Ic49b4f8cd3a7de9c411b86e38e6a09fdde9c39b7
Signed-off-by: Carlos Llamas <cmllamas@google.com>
This reverts commit 3d5bad71a7.
Upstream has removed pick_next_task_fair() in commit 5ad278dd20
("sched: Remove sched_class::pick_next_task()"), so we can't have this
hook there anymore. Plus, it doesn't seem to be critical functionality
to be in android-mainline.
Bug: 413566818
Cc: John Stultz <jstultz@google.com>
Change-Id: Ifc26a14474668f8462e1c9c94fdb969a2b76aab3
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Since commit 541c8f2468 ("dma-buf: detach fence ops on signal v3"),
I'm seeing the BUG_ON() triggering in drm_crtc's fence_to_crtc() via
drm_crtc_fence_get_driver_name() regularly:
Call trace:
panic+0x58/0x5c
die+0x160/0x178
bug_brk_handler+0x70/0xa4
call_el1_break_hook+0x3c/0x1a0
do_el1_brk64+0x24/0x74
el1_brk64+0x34/0x54
el1h_64_sync_handler+0x80/0xfc
el1h_64_sync+0x84/0x88
drm_crtc_fence_get_driver_name+0x60/0x68 (P)
sync_file_get_name+0x184/0x45c
sync_file_ioctl+0x404/0xf70
__arm64_sys_ioctl+0x124/0x1dc
This looks to be caused by a code flow similar to the following:
+++ snip +++
thread A thread B
ioctl(SYNC_IOC_FILE_INFO)
sync_file_ioctl()
sync_file_get_name()
dma_fence_signal_timestamp_locked() dma_fence_driver_name()
ops = rcu_dereference(fence->ops)
if (!dma_fence_test_signaled_flag())
ops->get_driver_name(fence) i.e.
drm_crtc_fence_get_driver_name()
test_and_set_bit(SIGNALED)
RCU_INIT_POINTER(fence->ops, NULL)
drm_crtc_fence_get_driver_name()
BUG_ON(rcu_access_pointer(fence->ops)
!= &drm_crtc_fence_ops)
+++ snap +++
In other words, a fence's ops pointer can now change to NULL on signal,
which wasn't the case before the culprit commit and hence the BUG_ON()
triggers.
Simply drop the BUG_ON() as it's usage of fence ops is invalid now, and
because using BUG_ON() and friends to take down the system is an
unacceptable way to handle a failure.
Note that the adjacent drm_crtc_fence_get_timeline_name() has the same
problem and is fixed by this patch as well.
Fixes: 541c8f2468 ("dma-buf: detach fence ops on signal v3")
Cc: stable@vger.kernel.org
Reviewed-by: Philipp Stanner <phasta@kernel.org>
Signed-off-by: André Draszik <andre.draszik@linaro.org>
Link: https://lore.kernel.org/all/20260721-linux-drm_crtc_fix2-v3-2-afa8c71506e6@linaro.org/
Bug: 521531791
Test: TH
Change-Id: I01392d150a93846f70889920ca120ec5c8baeee4
Signed-off-by: André Draszik <draszik@google.com>
Aaron Kling
Mikko Perttunen
Hung-Chun Tseng
Mayank Rungta
Zyta Szpak
Henry Dong
Todd Kjos
T.J. Mercier
Song Guo
Gokul Krishnakumar
Carlos Llamas
Howard Chen
Thiébaud Weksteen
Ulises Mendez Martinez
André Draszik