kernel/linux.git/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c, branch v4.19.283

drm/amdgpu: Fix buffer overflow in INFO ioctl

2020-09-03T09:24:29+00:00

commit b5b97cab55eb71daba3283c8b1d2cce456d511a1 upstream. The values for "se_num" and "sh_num" come from the user in the ioctl. They can be in the 0-255 range but if they're more than AMDGPU_GFX_MAX_SE (4) or AMDGPU_GFX_MAX_SH_PER_SE (2) then it results in an out of bounds read. Reported-by: Dan Carpenter Acked-by: Dan Carpenter Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms

2020-09-03T09:24:19+00:00

[ Upstream commit 9ba8923cbbe11564dd1bf9f3602add9a9cfbb5c6 ] in amdgpu_driver_open_kms the call to pm_runtime_get_sync increments the counter even in case of failure, leading to incorrect ref count. In case of failure, decrement the ref count before returning. Signed-off-by: Navid Emamdoost Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin

drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()

2020-08-05T08:06:01+00:00

commit 543e8669ed9bfb30545fd52bc0e047ca4df7fb31 upstream. Compiler leaves a 4-byte hole near the end of `dev_info`, causing amdgpu_info_ioctl() to copy uninitialized kernel stack memory to userspace when `size` is greater than 356. In 2015 we tried to fix this issue by doing `= {};` on `dev_info`, which unfortunately does not initialize that 4-byte hole. Fix it by using memset() instead. Cc: stable@vger.kernel.org Fixes: c193fa91b918 ("drm/amdgpu: information leak in amdgpu_info_ioctl()") Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") Suggested-by: Dan Carpenter Reviewed-by: Christian König Signed-off-by: Peilin Ye Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: Bail earlier when amdgpu.cik_/si_support is not set to 1

2019-10-29T08:19:55+00:00

commit 984d7a929ad68b7be9990fc9c5cfa5d5c9fc7942 upstream. Bail from the pci_driver probe function instead of from the drm_driver load function. This avoid /dev/dri/card0 temporarily getting registered and then unregistered again, sending unwanted add / remove udev events to userspace. Specifically this avoids triggering the (userspace) bug fixed by this plymouth merge-request: https://gitlab.freedesktop.org/plymouth/plymouth/merge_requests/59 Note that despite that being a userspace bug, not sending unnecessary udev events is a good idea in general. BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1490490 Reviewed-by: Daniel Vetter Signed-off-by: Hans de Goede Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: Check for valid number of registers to read

2019-10-11T16:21:17+00:00

[ Upstream commit 73d8e6c7b841d9bf298c8928f228fb433676635c ] Do not try to allocate any amount of memory requested by the user. Instead limit it to 128 registers. Actually the longest series of consecutive allowed registers are 48, mmGB_TILE_MODE0-31 and mmGB_MACROTILE_MODE0-15 (0x2644-0x2673). Bug: https://bugs.freedesktop.org/show_bug.cgi?id=111273 Signed-off-by: Trek Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin

drm/amdgpu: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime

2019-02-27T09:09:00+00:00

commit d33158530660bc89be3cc870a2152e4e9a76cac7 upstream. Based on a similar patch from Rafael for radeon. When using ATPX to control dGPU power, the state is not retained across suspend and resume cycles by default. This can probably be loosened for Hybrid Graphics (_PR3) laptops where I think the state is properly retained. Fixes: c62ec4610c40 ("PM / core: Fix direct_complete handling for devices with no callbacks") Cc: Rafael J. Wysocki Acked-by: Rafael J. Wysocki Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: wait for IB test on first device open

2018-12-21T13:15:15+00:00

[ Upstream commit 3bfa8897e4d08f822d1d58cf6cbbffbccef82e08 ] Instead of delaying that to the first query. Otherwise we could try to use the SDMA for VM updates before the IB tests are done. Signed-off-by: Christian König Reviewed-by: Chunming Zhou Reviewed-by: Junwei Zhang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin

drm/amdgpu: nuke amdgpu_bo_list_free

2018-07-31T21:58:18+00:00

The RCU grace period is harmless and avoiding it is not worth the effort of doubling the implementation. Signed-off-by: Christian König Reviewed-by: Chunming Zhou Reviewed-by: Huang Rui Signed-off-by: Alex Deucher

drm/amdgpu: implement harvesting support for UVD 7.2 (v3)

2018-07-27T14:07:44+00:00

Properly handle cases where one or more instance of the IP block may be harvested. v2: make sure ip_num_rings is initialized amdgpu_queue_mgr.c v3: rebase on Christian's UVD changes, drop unused var Reviewed-by: James Zhu Signed-off-by: Alex Deucher

drm/amdgpu: expose only the first UVD instance for now

2018-07-25T20:05:32+00:00

Going to completely rework the context to ring mapping with Nayan's GSoC work, but for now just stopping to expose the second UVD instance should do it. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher