kernel/linux.git/drivers/gpu/drm/drm_gem.c, branch v5.10.40

drm/shme-helpers: Fix dma_buf_mmap forwarding bug

2020-10-28T11:27:41+00:00

When we forward an mmap to the dma_buf exporter, they get to own everything. Unfortunately drm_gem_mmap_obj() overwrote vma->vm_private_data after the driver callback, wreaking the exporter complete. This was noticed because vb2_common_vm_close blew up on mali gpu with panfrost after commit 26d3ac3cb04d ("drm/shmem-helpers: Redirect mmap for imported dma-buf"). Unfortunately drm_gem_mmap_obj also acquires a surplus reference that we need to drop in shmem helpers, which is a bit of a mislayer situation. Maybe the entire dma_buf_mmap forwarding should be pulled into core gem code. Note that the only two other drivers which forward mmap in their own code (etnaviv and exynos) get this somewhat right by overwriting the gem mmap code. But they seem to still have the leak. This might be a good excuse to move these drivers over to shmem helpers completely. Reviewed-by: Boris Brezillon Acked-by: Christian König Cc: Christian König Cc: Sumit Semwal Cc: Lucas Stach Cc: Russell King Cc: Christian Gmeiner Cc: Inki Dae Cc: Joonyoung Shim Cc: Seung-Woo Kim Cc: Kyungmin Park Fixes: 26d3ac3cb04d ("drm/shmem-helpers: Redirect mmap for imported dma-buf") Cc: Boris Brezillon Cc: Thomas Zimmermann Cc: Gerd Hoffmann Cc: Rob Herring Cc: dri-devel@lists.freedesktop.org Cc: linux-media@vger.kernel.org Cc: linaro-mm-sig@lists.linaro.org Cc: # v5.9+ Reported-and-tested-by: piotr.oniszczuk@gmail.com Cc: piotr.oniszczuk@gmail.com Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20201027214922.3566743-1-daniel.vetter@ffwll.ch

Merge tag 'drm-misc-fixes-2020-08-04' of git://anongit.freedesktop.org/drm/drm-misc into drm-next

2020-08-11T02:00:30+00:00

* backmerge from drm-fixes at v5.8-rc7 * add orientation quirk for ASUS T103HAF * drm/omap: force runtime PM suspend on system suspend * drm/tidss: fix modeset init for DPI panels * re-added docs for drm_gem_flink_ioctl() * ttm: fix page-offset calculation within TTM Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20200804125510.GA29670@linux-uq9g

Merge tag 'v5.8' into drm-next

2020-08-11T01:58:31+00:00

I need to backmerge 5.8 as I've got a bunch of fixes sitting on an rc7 base that I want to land. Signed-off-by: Dave Airlie

drm: re-add deleted doc for drm_gem_open_ioctl

2020-07-31T09:17:24+00:00

Add back the removed documentation for drm_gem_open_ioctl. This patch is submitted in response to [1]. [1] https://lore.kernel.org/linux-arm-msm/20200728085244.GY6419@phenom.ffwll.local/ Signed-off-by: Steve Cohen Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/1596000952-27621-1-git-send-email-cohens@codeaurora.org

drm: hold gem reference until object is no longer accessed

2020-07-27T20:05:51+00:00

A use-after-free in drm_gem_open_ioctl can happen if the GEM object handle is closed between the idr lookup and retrieving the size from said object since a local reference is not being held at that point. Hold the local reference while the object can still be accessed to fix this and plug the potential security hole. Signed-off-by: Steve Cohen Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org

drm: Remove struct drm_driver.gem_print_info

2020-06-10T07:06:30+00:00

The .gem_print_info callback in struct drm_driver is obsolete and has no users left. Remove it. Signed-off-by: Thomas Zimmermann Suggested-by: Emil Velikov Reviewed-by: Emil Velikov Reviewed-by: Laurent Pinchart Link: https://patchwork.freedesktop.org/patch/msgid/20200605073247.4057-44-tzimmermann@suse.de

drm/gem: WARN if drm_gem_get_pages is called on a private obj

2020-06-03T12:48:26+00:00

No real functional change, since this just converts an annoying Oops into a more harmless WARNING backtrace. It's still a driver bug. Acked-by: Thomas Zimmermann Tested-by: Boris Brezillon Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20200511093554.211493-3-daniel.vetter@ffwll.ch

drm: remove _unlocked suffix in drm_gem_object_put_unlocked

2020-05-19T21:31:31+00:00

Spelling out _unlocked for each and every driver is a annoying. Especially if we consider how many drivers, do not know (or need to) about the horror stories involving struct_mutex. Just drop the suffix. It makes the API cleaner. Done via the following script: __from=drm_gem_object_put_unlocked __to=drm_gem_object_put for __file in $(git grep --name-only $__from); do sed -i "s/$__from/$__to/g" $__file; done Pay special attention to the compat #define v2: keep sed and #define removal separate Cc: David Airlie Cc: Daniel Vetter Signed-off-by: Emil Velikov Acked-by: Sam Ravnborg (v1) Reviewed-by: Steven Price Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20200515095118.2743122-14-emil.l.velikov@gmail.com

drm/gem: add _locked suffix to drm_gem_object_put

2020-05-19T21:31:30+00:00

Vast majority of DRM (core and drivers) are struct_mutex free. As such we have only a handful of cases where the locked helper should be used. Make that stand out a little bit better. Done via the following script: __from=drm_gem_object_put __to=drm_gem_object_put_locked for __file in $(git grep --name-only --word-regexp $__from); do sed -i "s/\<$__from\>/$__to/g" $__file; done Cc: Rob Clark Cc: Sean Paul Cc: linux-arm-msm@vger.kernel.org Signed-off-by: Emil Velikov Acked-by: Sam Ravnborg Reviewed-by: Steven Price Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20200515095118.2743122-12-emil.l.velikov@gmail.com

drm/gem: fold drm_gem_object_put_unlocked and __drm_gem_object_put()

2020-05-19T21:31:30+00:00

With earlier patch we removed the overhead so now we can lift the helper into the header effectively folding it with __drm_object_put. v2: drop struct_mutex references (Daniel) Signed-off-by: Emil Velikov Acked-by: Sam Ravnborg (v1) Reviewed-by: Daniel Vetter Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20200515095118.2743122-11-emil.l.velikov@gmail.com