Short summary of fixes pull:

* dma-buf: Include <linux/vmalloc.h> for building on MIPS
  * komeda: Fix order of operation in commit tail; Fix NULL-pointer and
            out-of-bounds access; Cleanups
  * ttm: Fix an unused-function warning
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAl/iRSAACgkQaA3BHVML
 eiMrsQf/dlHwJykbsGbkE/lG8qgrnz4jFKkei+DnZjqNaAwvgbz9s1YvaMYIIdsE
 wvYnBSTvdvhYzde08+E0Q4JLCvHh/0aHWqkZR3dGd22tAgNxGfslBITu07EyI+k8
 Agy4AeBbYJUwYcfRAHqwDuKCDQ28/FXcBpLajSF9K9oG6et2GgftshuIwWij2xNR
 kNQTddCsXdXXbFDK/N3X/Inb+WSbRU0GWDTMTUPC31rMXX6kIKASQmVvCQ8h6a5F
 N9EqjUmGf7XGjdqWEkSM34HpCUv5c5N2MWc4OAiSaP3Q3QVJyp3RHg8zLOpeSIsy
 hVAj+8SN8UrI+Fz0Tx+SFdU72t0eVA==
 =hlDA
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-next-fixes-2020-12-22' of git://anongit.freedesktop.org/drm/drm-misc into drm-next

Short summary of fixes pull:

 * dma-buf: Include <linux/vmalloc.h> for building on MIPS
 * komeda: Fix order of operation in commit tail; Fix NULL-pointer and
           out-of-bounds access; Cleanups
 * ttm: Fix an unused-function warning

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/X+JFYlW1SEZa6ShA@linux-uq9g

drivers/dma-buf/heaps/cma_heap.c

@@ -20,6 +20,7 @@
 #include <linux/module.h>
 #include <linux/scatterlist.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 
 
 struct cma_heap {

drivers/gpu/drm/arm/display/komeda/komeda_dev.c

@@ -152,7 +152,6 @@ static int komeda_parse_dt(struct device *dev, struct komeda_dev *mdev)
 	ret = of_reserved_mem_device_init(dev);
 	if (ret && ret != -ENODEV)
 		return ret;
-	ret = 0;
 
 	for_each_available_child_of_node(np, child) {
 		if (of_node_name_eq(child, "pipeline")) {

drivers/gpu/drm/arm/display/komeda/komeda_kms.c

@@ -81,10 +81,10 @@ static void komeda_kms_commit_tail(struct drm_atomic_state *old_state)
 
 	drm_atomic_helper_commit_modeset_enables(dev, old_state);
 
-	drm_atomic_helper_wait_for_flip_done(dev, old_state);
-
 	drm_atomic_helper_commit_hw_done(old_state);
 
+	drm_atomic_helper_wait_for_flip_done(dev, old_state);
+
 	drm_atomic_helper_cleanup_planes(dev, old_state);
 }
 

drivers/gpu/drm/arm/display/komeda/komeda_pipeline.c

@@ -137,9 +137,10 @@ komeda_pipeline_get_first_component(struct komeda_pipeline *pipe,
 				    u32 comp_mask)
 {
 	struct komeda_component *c = NULL;
+	unsigned long comp_mask_local = (unsigned long)comp_mask;
 	int id;
 
-	id = find_first_bit((unsigned long *)&comp_mask, 32);
+	id = find_first_bit(&comp_mask_local, 32);
 	if (id < 32)
 		c = komeda_pipeline_get_component(pipe, id);
 

drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c

@@ -704,10 +704,10 @@ komeda_compiz_set_input(struct komeda_compiz *compiz,
 	cin->layer_alpha = dflow->layer_alpha;
 
 	old_st = komeda_component_get_old_state(&compiz->base, drm_st);
-	WARN_ON(!old_st);
 
 	/* compare with old to check if this input has been changed */
-	if (memcmp(&(to_compiz_st(old_st)->cins[idx]), cin, sizeof(*cin)))
+	if (WARN_ON(!old_st) ||
+	    memcmp(&(to_compiz_st(old_st)->cins[idx]), cin, sizeof(*cin)))
 		c_st->changed_active_inputs |= BIT(idx);
 
 	komeda_component_add_input(c_st, &dflow->input, idx);

drivers/gpu/drm/ttm/ttm_pool.c

@@ -239,21 +239,6 @@ static struct page *ttm_pool_type_take(struct ttm_pool_type *pt)
 	return p;
 }
 
-/* Count the number of pages available in a pool_type */
-static unsigned int ttm_pool_type_count(struct ttm_pool_type *pt)
-{
-	unsigned int count = 0;
-	struct page *p;
-
-	spin_lock(&pt->lock);
-	/* Only used for debugfs, the overhead doesn't matter */
-	list_for_each_entry(p, &pt->pages, lru)
-		++count;
-	spin_unlock(&pt->lock);
-
-	return count;
-}
-
 /* Initialize and add a pool type to the global shrinker list */
 static void ttm_pool_type_init(struct ttm_pool_type *pt, struct ttm_pool *pool,
 			       enum ttm_caching caching, unsigned int order)
@@ -543,6 +528,20 @@ void ttm_pool_fini(struct ttm_pool *pool)
 EXPORT_SYMBOL(ttm_pool_fini);
 
 #ifdef CONFIG_DEBUG_FS
+/* Count the number of pages available in a pool_type */
+static unsigned int ttm_pool_type_count(struct ttm_pool_type *pt)
+{
+	unsigned int count = 0;
+	struct page *p;
+
+	spin_lock(&pt->lock);
+	/* Only used for debugfs, the overhead doesn't matter */
+	list_for_each_entry(p, &pt->pages, lru)
+		++count;
+	spin_unlock(&pt->lock);
+
+	return count;
+}
 
 /* Dump information about the different pool types */
 static void ttm_pool_debugfs_orders(struct ttm_pool_type *pt,