kernel/linux.git/drivers/gpu/drm/drm_bufs.c, branch v4.9.289

drm/bufs: Fix Spectre v1 vulnerability

2019-02-12T18:44:50+00:00

[ Upstream commit a37805098900a6e73a55b3a43b7d3bcd987bb3f4 ] idx can be indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: drivers/gpu/drm/drm_bufs.c:1420 drm_legacy_freebufs() warn: potential spectre issue 'dma->buflist' [r] (local cap) Fix this by sanitizing idx before using it to index dma->buflist Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Signed-off-by: Gustavo A. R. Silva Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20181016095549.GA23586@embeddedor.com Signed-off-by: Sasha Levin

GPU-DRM: Replace a kzalloc() call by kcalloc() in drm_legacy_addbufs_sg()

2016-09-21T11:24:27+00:00

The script "checkpatch.pl" can point information out like the following. WARNING: Prefer kcalloc over kzalloc with multiply Thus fix the affected source code place. Signed-off-by: Markus Elfring Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/b340d1ca-f114-a523-e6d1-afe7fd6c3826@users.sourceforge.net

GPU-DRM: Replace a kzalloc() call by kcalloc() in drm_legacy_addbufs_agp()

2016-09-21T11:24:27+00:00

The script "checkpatch.pl" can point information out like the following. WARNING: Prefer kcalloc over kzalloc with multiply Thus fix the affected source code place. Signed-off-by: Markus Elfring Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/606c22f3-5da5-2e84-783d-bfe5289b4a01@users.sourceforge.net

GPU-DRM: Replace two kzalloc() calls by kcalloc() in drm_legacy_addbufs_pci()

2016-09-21T11:24:27+00:00

The script "checkpatch.pl" can point information out like the following. WARNING: Prefer kcalloc over kzalloc with multiply Thus fix the affected source code places. Signed-off-by: Markus Elfring Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/51f88f44-130d-48ac-f531-32ca9ae3919f@users.sourceforge.net

GPU-DRM: Use kmalloc_array() in drm_legacy_addbufs_pci()

2016-09-21T11:24:27+00:00

A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus use the corresponding function "kmalloc_array". This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/b71c8fee-8e84-9f1b-8569-f1ae8b879cc5@users.sourceforge.net

drm: Used DRM_LEGACY for all legacy functions

2016-08-08T08:05:23+00:00

Except for nouveau, only legacy drivers need this really. And nouveau is already marked up with DRIVER_KMS_LEGACY_CONTEXT as the special case. I've tried to be careful to leave everything related to modeset still using the DRIVER_MODESET flag. Otherwise it's a direct replacement of !DRIVER_MODESET with DRIVER_LEGACY checks. Also helps readability since fewer negative checks overall. Reviewed-by: David Herrmann Reviewed-by: Frank Binns Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1470251470-30830-2-git-send-email-daniel.vetter@ffwll.ch

drm: Move master pointer from drm_minor to drm_device

2016-06-21T19:43:24+00:00

There can only be one current master, and it's for the overall device. Render/control minors don't support master-based auth at all. This simplifies the master logic a lot, at least in my eyes: All these additional pointer chases are just confusing. While doing the conversion I spotted some locking fail: - drm_lock/drm_auth check dev->master without holding the master_mutex. This is fallout from commit c996fd0b956450563454e7ccc97a82ca31f9d043 Author: Thomas Hellstrom Date: Tue Feb 25 19:57:44 2014 +0100 drm: Protect the master management with a drm_device::master_mutex v3 but I honestly don't care one bit about those old legacy drivers using this. - debugfs name info should just grab master_mutex. - And the fbdev helper looked at it to figure out whether someone is using KMS. We just need a consistent value, so READ_ONCE. Aside: We should probably check if anyone has opened a control node too, but I guess current userspace doesn't really do that yet. v2: Balance locking, reported by Julia. v3: Rebase on top of Chris' oops fixes. Cc: Julia Lawall Cc: Chris Wilson Reviewed-by: Chris Wilson (v2) Reviewed-by: Emil Velikov (v2) Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1466499262-18717-1-git-send-email-daniel.vetter@ffwll.ch

drm: Hide master MAP cleanup in drm_bufs.c

2016-04-27T08:14:17+00:00

And again make sure it's a no-op for modern drivers. Another case of dev->struct_mutex gone for modern drivers! Note that the entirety of the legacy addmap interface is now protected by DRIVER_MODESET. Note that just auditing kernel code is not enough, since userspace loves to set up legacy maps on it's own for various things - with ums userspace and kernel space share control over resources. v2: Also add a DRIVER_* check like for all other maps functions to really short-circuit the code. And give drm_legacy_rmmap used by the dev unregister code the same treatment. v3: - remove redundant return; (Alex, Chris) - don't special case nouveau with DRIVER_KMS_LEGACY_CONTEXT. v4: Again special case nouveau. The problem is not directly in the ddx, but that it calls dri1 functions from the X server. And those do call drmAddMap. Fixed only in commit b1a630b48210d6a3c44994fce1b73273000ace5c Author: Dave Airlie Date: Wed Nov 7 14:45:14 2012 +1000 nouveau: drop DRI1 device open interface. Acked-by: Alex Deucher Reviewed-by: Chris Wilson Cc: Alex Deucher Cc: Chris Wilson Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1461741618-12679-1-git-send-email-daniel.vetter@ffwll.ch

drm: Forbid legacy MAP functions for DRIVER_MODESET

2016-04-27T08:05:54+00:00

Like in commit 0e975980d435d58df2d430d688b8c18778b42218 Author: Peter Antoine Date: Tue Jun 23 08:18:49 2015 +0100 drm: Turn off Legacy Context Functions we need to again make an exception for nouveau, but everyone else really doesn't need this. Dave Airlie dug out again why we need this: The problem is the legacy dri1 open function the nouveau ddx called, and the problematic code is actually in the X server itself. It was only fixed in commit b1a630b48210d6a3c44994fce1b73273000ace5c Author: Dave Airlie Date: Wed Nov 7 14:45:14 2012 +1000 nouveau: drop DRI1 device open interface. Cc: Peter Antoine Cc: Ben Skeggs Acked-by: Alex Deucher Acked-by: Dave Airlie Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1461691808-12414-5-git-send-email-daniel.vetter@ffwll.ch Link: http://patchwork.freedesktop.org/patch/msgid/1461691808-12414-6-git-send-email-daniel.vetter@ffwll.ch

drm: Move drm_getmap into drm_bufs.c and give it a legacy prefix

2016-04-27T06:42:48+00:00

It belongs right next to the addmap and rmmap functions really. And for OCD consistency name it drm_legacy_getmap_ioctl. Reviewed-by: Chris Wilson Reviewed-by: Alex Deucher Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1461691808-12414-4-git-send-email-daniel.vetter@ffwll.ch