kernel/linux.git/drivers/gpu/drm/drm_property.c, branch v5.10.263

drm: Account property blob allocations to memcg

2026-03-04T12:19:58+00:00

[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized property blobs backed by kernel memory. Currently, the blob data allocation is not accounted to the allocating process's memory cgroup, allowing unprivileged users to trigger unbounded kernel memory consumption and potentially cause system-wide OOM. Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory is properly charged to the caller's memcg. This ensures existing cgroup memory limits apply and prevents uncontrolled kernel memory growth without introducing additional policy or per-file limits. Signed-off-by: Xiao Kan <814091656@qq.com> Signed-off-by: Xiao Kan Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com Signed-off-by: Maxime Ripard Signed-off-by: Sasha Levin

drm: limit to INT_MAX in create_blob ioctl

2019-12-05T03:44:13+00:00

The hardened usercpy code is too paranoid ever since commit 6a30afa8c1fb ("uaccess: disallow > INT_MAX copy sizes") Code itself should have been fine as-is. Link: http://lkml.kernel.org/r/20191106164755.31478-1-daniel.vetter@ffwll.ch Signed-off-by: Daniel Vetter Reported-by: syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com Fixes: 6a30afa8c1fb ("uaccess: disallow > INT_MAX copy sizes") Cc: Kees Cook Cc: Alexander Viro Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

drm: drop use of drmP.h in drm/*

2019-05-27T16:07:03+00:00

The use of the drmP.h header file is deprecated. Remove use from all files in drm/* so people do not look there and follow a bad example. Build tested allyesconfig,allmodconfig on x86, arm etc. Including alpha that is as always more challenging than the rest. Signed-off-by: Sam Ravnborg Acked-by: Daniel Vetter Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Sean Paul Cc: David Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20190526173535.32701-8-sam@ravnborg.org

drm: Trivial comment grammar cleanups

2019-02-04T09:21:17+00:00

Most of these are just cases where code comments used contractions (it's, who's) where they actually mean to use a possessive pronoun (its, whose) or vice-versa. Signed-off-by: Matt Roper Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20190202012326.20096-1-matthew.d.roper@intel.com

drm: Differentiate the lack of an interface from invalid parameter

2018-09-14T16:29:47+00:00

If the ioctl is not supported on a particular piece of HW/driver combination, report ENOTSUP (aka EOPNOTSUPP) so that it can be easily distinguished from both the lack of the ioctl and from a regular invalid parameter. v2: Across all the kms ioctls we had a mixture of reporting EINVAL, ENODEV and a few ENOTSUPP (most where EINVAL) for a failed drm_core_check_feature(). Update everybody to report ENOTSUPP. v3: ENOTSUPP is an internal errno! It's value (524) does not correspond to a POSIX errno, the one we want is ENOTSUP. However, uapi/asm-generic/errno.h doesn't include ENOTSUP but man errno says "ENOTSUP and EOPNOTSUPP have the same value on Linux, but according to POSIX.1 these error values should be distinct." so use EOPNOTSUPP as its equivalent. Signed-off-by: Chris Wilson Cc: Daniel Vetter Cc: Ville Syrjälä Reviewed-by: Daniel Vetter #v2 Link: https://patchwork.freedesktop.org/patch/msgid/20180913192050.24812-1-chris@chris-wilson.co.uk

drm: Use kvzalloc for allocating blob property memory

2018-07-02T16:05:21+00:00

The property size may be controlled by userspace, can be large (I've seen failure with order 4, i.e. 16 pages / 64 KB) and doesn't need to be physically contiguous. Signed-off-by: Michel Dänzer Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20180629142710.2069-1-michel@daenzer.net Cc: stable@vger.kernel.org

drm: Don't pass the index to drm_property_add_enum()

2018-04-27T13:46:50+00:00

drm_property_add_enum() can calculate the index itself just fine, so no point in having the caller pass it in. Cc: Patrik Jakobsson Cc: Ben Skeggs Cc: nouveau@lists.freedesktop.org Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20180316190420.26734-1-ville.syrjala@linux.intel.com Reviewed-by: Stanislav Lisovskiy

Revert "drm: Use a flexible array member for blob property data"

2018-03-16T13:44:01+00:00

Using a flexible array for the blob data was a mistake by me. It forces all users of the blob data to cast blob->data to something else. void* is clearly superior so let's go back to the original scheme. Not a clean revert as the code has moved. This reverts commit d63f5e6bf6f2a1573ea39c9937cdf5ab0b3a4b77. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20180223192506.29992-1-ville.syrjala@linux.intel.com Reviewed-by: Shashank Sharma Reviewed-by: Daniel Vetter

drm: Reject bad property flag combinations

2018-03-07T16:28:34+00:00

Pimp drm_property_type_valid() to check for more fails with the property flags. Also make the check before adding the property, and bail out if things look bad. Since we're now chekcing for more than the type let's also change the function name to drm_property_flags_valid(). Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20180306164849.2862-6-ville.syrjala@linux.intel.com Reviewed-by: Daniel Vetter

drm: Make property flags u32

2018-03-07T16:25:43+00:00

The property flags are part of the uabi and we have 32 bits for them. Pass them around as u32 internally as well, instead of a signed int. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20180306164849.2862-5-ville.syrjala@linux.intel.com Reviewed-by: Daniel Vetter