kernel/linux.git/drivers/gpu/drm/drm_gem.c, branch v4.19.265

drm: hold gem reference until object is no longer accessed

2020-08-05T08:06:01+00:00

commit 8490d6a7e0a0a6fab5c2d82d57a3937306660864 upstream. A use-after-free in drm_gem_open_ioctl can happen if the GEM object handle is closed between the idr lookup and retrieving the size from said object since a local reference is not being held at that point. Hold the local reference while the object can still be accessed to fix this and plug the potential security hole. Signed-off-by: Steve Cohen Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org Signed-off-by: Greg Kroah-Hartman

drm/i915: Prevent writing into a read-only object via a GGTT mmap

2018-07-13T15:14:04+00:00

If the user has created a read-only object, they should not be allowed to circumvent the write protection by using a GGTT mmapping. Deny it. Also most machines do not support read-only GGTT PTEs, so again we have to reject attempted writes. Fortunately, this is known a priori, so we can at least reject in the call to create the mmap (with a sanity check in the fault handler). v2: Check the vma->vm_flags during mmap() to allow readonly access. v3: Remove VM_MAYWRITE to curtail mprotect() Testcase: igt/gem_userptr_blits/readonly_mmap* Signed-off-by: Chris Wilson Cc: Jon Bloomfield Cc: Joonas Lahtinen Cc: Matthew Auld Cc: David Herrmann Reviewed-by: Matthew Auld #v1 Reviewed-by: Jon Bloomfield Reviewed-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20180712185315.3288-4-chris@chris-wilson.co.uk

drm/gem: Document that handle_create must be the last step

2018-03-26T15:42:06+00:00

It published the gem object to userspace, by that point other threads can guess the id and start using it. And gem IDs are _very_ easy to guess (it's just an idr). Since gem objects is the only thing we allow drivers to create themselves (all the kms/prime/syncobj stuff is handled by the core) no other functions seem to be in need of this clarification. Motivated by reviewing the xen-front kms driver. Cc: Oleksandr Andrushchenko Reviewed-by: Oleksandr Andrushchenko Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20180322080233.17266-1-daniel.vetter@ffwll.ch

drm: Use idr_init_base(1) when using id==0 for invalid

2018-02-19T12:21:24+00:00

Use the new idr_init_base() function to create an IDR that knows id==0 is never allocated as it maps to an invalid identifier. By knowing that id==0 is invalid, the IDR can start from id=1 instead avoiding the issue of having to start each lookup from the zeroth leaf as id==0 is always unused (and thus the tree-of-bitmaps indicate that is the first available). References: 6ce711f27500 ("idr: Make 1-based IDRs more efficient") Signed-off-by: Chris Wilson Cc: Daniel Vetter Cc: Christian Konig Cc: Dave Airlie Reviewed-by: Ville Syrjälä Acked-by: Christian König as well. Link: https://patchwork.freedesktop.org/patch/msgid/20180212145533.30046-1-chris@chris-wilson.co.uk

drm/framebuffer: Add framebuffer debugfs file

2017-11-11T10:21:19+00:00

Add debugfs file that dumps info about the framebuffers and its planes. Also dump info about any connected gem object(s). Reviewed-by: Daniel Vetter Signed-off-by: Noralf Trønnes Reviewed-by: Laurent Pinchart Link: https://patchwork.freedesktop.org/patch/msgid/20171107191348.17555-5-noralf@tronnes.org

drm/gem: Remove trailing whitespace

2017-10-27T15:20:09+00:00

Remove two trailing spaces. Signed-off-by: Noralf Trønnes Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20171026165731.5793-4-noralf@tronnes.org

drm: fix typo in drm_gem_get_pages() comment

2017-10-04T16:04:28+00:00

I spent an embarrassingly long time looking for drm_gem_init_object() before I realized I was actually looking for drm_gem_object_init(). Fix the typo to keep other poor developers from suffering the same fate. Signed-off-by: Jordan Crouse Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/1507045091-6550-1-git-send-email-jcrouse@codeaurora.org

Merge airlied/drm-next into drm-misc-next

2017-10-03T09:09:16+00:00

Just catching up with upstream. Signed-off-by: Daniel Vetter

Merge tag 'drm-misc-next-2017-09-20' of git://anongit.freedesktop.org/git/drm-misc into drm-next

2017-09-27T19:46:15+00:00

UAPI Changes: Cross-subsystem Changes: Core Changes: - DP SDP defines (Ville) - polish for scdc helpers (Thierry Reding) - fix lifetimes for connector/plane state across crtc changes (Maarten Lankhorst). - sparse fixes (Ville+Thierry) - make legacy kms ioctls all interruptible (Maarten) - push edid override into the edid helpers (out of probe helpers) (Jani) - DP ESI defines for link status (DK) Driver Changes: - drm-panel is now in drm-misc! - minor panel-simple cleanups/refactoring by various folks - drm_bridge_add cleanup (Inki Dae) - constify a few i2c_device_id structs (Arvind Yadav) - More patches from Noralf's fb/gem helper cleanup - bridge/synopsis: reset fix (Philippe Cornu) - fix tracepoint include handling in drivers (Thierry) - rockchip: lvds support (Sandy Huang) - move sun4i into drm-misc fold (Maxime Ripard) - sun4i: refactor driver load + support TCON backend/layer muxing (Chen-Yu Tsai) - pl111: support more pl11x variants (Linus Walleij) - bridge/adv7511: robustify probing/edid handling (Lars-Petersen Clausen) New hw support: - S6E63J0X03 panel (Hoegeun Kwon) - OTM8009A panel (Philippe CORNU) - Seiko 43WVF1G panel (Marco Franchi) - tve200 driver (Linus Walleij) Plus assorted of tiny patches all over, including our first outreachy patches from applicants for the winter round! * tag 'drm-misc-next-2017-09-20' of git://anongit.freedesktop.org/git/drm-misc: (101 commits) drm: add backwards compatibility support for drm_kms_helper.edid_firmware drm: handle override and firmware EDID at drm_do_get_edid() level drm/dp: DPCD register defines for link status within ESI field drm/rockchip: Replace dev_* with DRM_DEV_* drm/tinydrm: Drop driver registered message drm/gem-fb-helper: Use debug message on gem lookup failure drm/imx: Use drm_gem_fb_create() and drm_gem_fb_prepare_fb() drm/bridge: adv7511: Constify HDMI CODEC platform data drm/bridge: adv7511: Enable connector polling when no interrupt is specified drm/bridge: adv7511: Remove private copy of the EDID drm/bridge: adv7511: Properly update EDID when no EDID was found drm/crtc: Convert setcrtc ioctl locking to interruptible. drm/atomic: Convert pageflip ioctl locking to interruptible. drm/legacy: Convert setplane ioctl locking to interruptible. drm/legacy: Convert cursor ioctl locking to interruptible. drm/atomic: Convert atomic ioctl locking to interruptible. drm/atomic: Prepare drm_modeset_lock infrastructure for interruptible waiting, v2. drm/tve200: Clean up panel bridging drm/doc: Update todo.rst drm/dp/mst: Sideband message transaction to power up/down nodes ...

drm: Remove obsolete "This is gross" comment

2017-09-26T05:23:18+00:00

Remove obsolete comment which was initially added in 2008 to annotate that idr_find() was used before idr_remove() since idr_remove() didn't use to return feedback. The comment now is irrelevant with commit f6cd7daecff5 ("drm: Release driver references to handle before making it available again"). Signed-off-by: Haneen Mohammed Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20170921210424.GA21951@Haneen