Short summary of fixes pull:

dma-buf:
 - Fix dma_fence_array_signaled() to ensure forward progress
 
 dp_mst:
 - Fix MST sideband message body length check
 
 sti:
 - Add __iomem for mixer_dbg_mxn()'s parameter
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmdIdsMACgkQaA3BHVML
 eiNa3wf/ZcuAWIwVNwfVPB0sJ5T7+OchdM07U87iaR7AF93KHqBIvBq47Pj3gPl7
 gS6Q4TIK759Q3e5OCHSRAqLSteIayEQMS6IXAp/QE107ID0a71JyzneFd9TZolrM
 PSe502NPIt3ujo0xFCIkJKki+PzzEwYr3bXKQCXH4/6hWNPCR9cBlklYqplAS5y8
 6OCuN71t4WWGx1iAM3QMso4doulsAJHAp19sT8gKwMwtczZMBThUof0odnyiwaKG
 DIWBNMfbb4i4fiGwIzzFjsiYti3c9YkssHk2yfTM5Q5loDhyqJlh/lOnbm5LVQfr
 7m9LS0CSJBBh7CURAJECdIpy7X9CPw==
 =VCf1
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2024-11-28' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

Short summary of fixes pull:

dma-buf:
- Fix dma_fence_array_signaled() to ensure forward progress

dp_mst:
- Fix MST sideband message body length check

sti:
- Add __iomem for mixer_dbg_mxn()'s parameter

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20241128135958.GA244627@linux.fritz.box

drivers/dma-buf/dma-fence-array.c

@@ -103,10 +103,36 @@ static bool dma_fence_array_enable_signaling(struct dma_fence *fence)
 static bool dma_fence_array_signaled(struct dma_fence *fence)
 {
 	struct dma_fence_array *array = to_dma_fence_array(fence);
+	int num_pending;
+	unsigned int i;
 
-	if (atomic_read(&array->num_pending) > 0)
+	/*
+	 * We need to read num_pending before checking the enable_signal bit
+	 * to avoid racing with the enable_signaling() implementation, which
+	 * might decrement the counter, and cause a partial check.
+	 * atomic_read_acquire() pairs with atomic_dec_and_test() in
+	 * dma_fence_array_enable_signaling()
+	 *
+	 * The !--num_pending check is here to account for the any_signaled case
+	 * if we race with enable_signaling(), that means the !num_pending check
+	 * in the is_signalling_enabled branch might be outdated (num_pending
+	 * might have been decremented), but that's fine. The user will get the
+	 * right value when testing again later.
+	 */
+	num_pending = atomic_read_acquire(&array->num_pending);
+	if (test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT, &array->base.flags)) {
+		if (num_pending <= 0)
+			goto signal;
 		return false;
+	}
 
+	for (i = 0; i < array->num_fences; ++i) {
+		if (dma_fence_is_signaled(array->fences[i]) && !--num_pending)
+			goto signal;
+	}
+	return false;
+
+signal:
 	dma_fence_array_clear_pending_error(array);
 	return true;
 }

drivers/gpu/drm/display/drm_dp_mst_topology.c

@@ -320,6 +320,9 @@ static bool drm_dp_decode_sideband_msg_hdr(const struct drm_dp_mst_topology_mgr
 	hdr->broadcast = (buf[idx] >> 7) & 0x1;
 	hdr->path_msg = (buf[idx] >> 6) & 0x1;
 	hdr->msg_len = buf[idx] & 0x3f;
+	if (hdr->msg_len < 1)		/* min space for body CRC */
+		return false;
+
 	idx++;
 	hdr->somt = (buf[idx] >> 7) & 0x1;
 	hdr->eomt = (buf[idx] >> 6) & 0x1;

drivers/gpu/drm/sti/sti_mixer.c

@@ -137,7 +137,7 @@ static void mixer_dbg_crb(struct seq_file *s, int val)
 	}
 }
 
-static void mixer_dbg_mxn(struct seq_file *s, void *addr)
+static void mixer_dbg_mxn(struct seq_file *s, void __iomem *addr)
 {
 	int i;