kernel/linux.git/drivers/gpu/drm/drm_gem.c, branch v5.4.224

drm/gem: Fix GEM handle release errors

2022-09-15T10:04:53+00:00

[ Upstream commit ea2aa97ca37a9044ade001aef71dbc06318e8d44 ] Currently we are assuming a one to one mapping between dmabuf and GEM handle when releasing GEM handles. But that is not always true, since we would create extra handles for the GEM obj in cases like gem_open() and getfb{,2}(). A similar issue was reported at: https://lore.kernel.org/all/20211105083308.392156-1-jay.xu@rock-chips.com/ Another problem is that the imported dmabuf might not always have gem_obj->dma_buf set, which would cause leaks in drm_gem_remove_prime_handles(). Let's fix these for now by using handle to find the exact map to remove. Signed-off-by: Jeffy Chen Reviewed-by: Christian König Signed-off-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20220819072834.17888-1-jeffy.chen@rock-chips.com Signed-off-by: Sasha Levin

drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error

2022-08-25T09:17:23+00:00

commit 2939deac1fa220bc82b89235f146df1d9b52e876 upstream. Use ww_acquire_fini() in the error code paths. Otherwise lockdep thinks that lock is held when lock's memory is freed after the drm_gem_lock_reservations() error. The ww_acquire_context needs to be annotated as "released", which fixes the noisy "WARNING: held lock freed!" splat of VirtIO-GPU driver with CONFIG_DEBUG_MUTEXES=y and enabled lockdep. Cc: stable@vger.kernel.org Fixes: 7edc3e3b975b5 ("drm: Add helpers for locking an array of BO reservations.") Reviewed-by: Thomas Hellström Reviewed-by: Christian König Signed-off-by: Dmitry Osipenko Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20220630200405.1883897-2-dmitry.osipenko@collabora.com Signed-off-by: Greg Kroah-Hartman

drm/gem: Fix a leak in drm_gem_objects_lookup()

2020-08-19T06:16:05+00:00

[ Upstream commit ec0bb482de0ad5e4aba2a4537ea53eaeb77d11a6 ] If the "handles" allocation or the copy_from_user() fails then we leak "objs". It's supposed to be freed in panfrost_job_cleanup(). Fixes: c117aa4d8701 ("drm: Add a drm_gem_objects_lookup helper") Signed-off-by: Dan Carpenter Signed-off-by: Emil Velikov Link: https://patchwork.freedesktop.org/patch/msgid/20200320132334.GC95012@mwanda Signed-off-by: Sasha Levin

drm: hold gem reference until object is no longer accessed

2020-08-05T07:59:44+00:00

commit 8490d6a7e0a0a6fab5c2d82d57a3937306660864 upstream. A use-after-free in drm_gem_open_ioctl can happen if the GEM object handle is closed between the idr lookup and retrieving the size from said object since a local reference is not being held at that point. Hold the local reference while the object can still be accessed to fix this and plug the potential security hole. Signed-off-by: Steve Cohen Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org Signed-off-by: Greg Kroah-Hartman

dma-buf: rename reservation_object to dma_resv

2019-08-13T07:09:30+00:00

Be more consistent with the naming of the other DMA-buf objects. Signed-off-by: Christian König Reviewed-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/323401/

drm/gem: Allow sparsely populated page arrays in drm_gem_put_pages

2019-08-12T20:17:09+00:00

Panfrost has a need for pages allocated on demand via GPU page faults. When releasing the pages, the only thing preventing using drm_gem_put_pages() is needing to skip over unpopulated pages, so allow for skipping over NULL struct page pointers. Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Sean Paul Cc: David Airlie Cc: Daniel Vetter Cc: dri-devel@lists.freedesktop.org Reviewed-by: Steven Price Acked-by: Alyssa Rosenzweig Reviewed-by: Eric Anholt Signed-off-by: Rob Herring Link: https://patchwork.freedesktop.org/patch/msgid/20190808222200.13176-2-robh@kernel.org

Revert "drm/gem: Rename drm_gem_dumb_map_offset() to drm_gem_map_offset()"

2019-08-07T15:56:48+00:00

This reverts commit 220df83a5394fbf7c1486ba7848794b7b351d598. Turns out drm_gem_dumb_map_offset really only worked for the dumb buffer case, so revert the name change. Signed-off-by: Rob Herring Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20190807145253.2037-2-sean@poorly.run

Revert "Revert "drm/gem: Rename drm_gem_dumb_map_offset() to drm_gem_map_offset()""

2019-08-07T14:44:13+00:00

This reverts commit 415d2e9e07574d3de63b8df77dc686e0ebf64865. Mandatory review was missing from this patch. Acked-by: Maxime Ripard Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20190807142101.251400-2-sean@poorly.run

dma-buf: add more reservation object locking wrappers

2019-08-05T07:28:43+00:00

Complete the abstraction of the ww_mutex inside the reservation object. This allows us to add more handling and debugging to the reservation object in the future. Signed-off-by: Christian König Reviewed-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/320761/

drm: direct include of drm.h in drm_gem.c

2019-07-19T21:24:17+00:00

Do not rely on including drm.h from drm_file.h, as the include in drm_file.h will be dropped. Signed-off-by: Sam Ravnborg Reviewed-by: Sean Paul Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: Daniel Vetter Cc: Eric Anholt Cc: Thomas Zimmermann Cc: Rob Herring Link: https://patchwork.freedesktop.org/patch/msgid/20190718161507.2047-7-sam@ravnborg.org