kernel/linux.git/drivers/gpu/drm/msm, branch v3.16.50Linux kernel stable tree (mirror)https://git.radix-linux.su/kernel/linux.git/atom?h=v3.16.502017-11-11T13:33:13+00:00drm/msm: fix an integer overflow test2017-11-11T13:33:13+00:00Dan Carpenterdan.carpenter@oracle.com2017-06-30T07:59:15+00:00urn:sha1:7bdb3e7e18fefdf70fc821763395f715ecfc0827
commit 65e93108891e571f177c202add9288eda9ac4100 upstream.
We recently added an integer overflow check but it needs an additional
tweak to work properly on 32 bit systems.
The problem is that we're doing the right hand side of the assignment as
type unsigned long so the max it will have an integer overflow instead
of being larger than SIZE_MAX. That means the "sz > SIZE_MAX" condition
is never true even on 32 bit systems. We need to first cast it to u64
and then do the math.
Fixes: 4a630fadbb29 ("drm/msm: Fix potential buffer overflow issue")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
[bwh: Backported to 3.16: submit_create() only supports a variable number of bos]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drm/msm: Fix potential buffer overflow issue2017-11-11T13:33:12+00:00Kasin Lidonglil@codeaurora.org2017-06-19T21:36:53+00:00urn:sha1:c73391e6723e4117c79970e6fa6540797c09f6f4
commit 4a630fadbb29d9efaedb525f1a8f7449ad107641 upstream.
In function submit_create, if nr_cmds or nr_bos is assigned with
negative value, the allocated buffer may be small than intended.
Using this buffer will lead to buffer overflow issue.
Signed-off-by: Kasin Li <donglil@codeaurora.org>
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
[bwh: Backported to 3.16: submit_create() only supports a variable number of bos]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drm/msm/hdmi: Use bitwise operators when building register values2017-10-12T14:27:50+00:00Liviu DudauLiviu.Dudau@arm.com2017-06-15T14:13:46+00:00urn:sha1:6d8c76588c1b03d63c8b76eaabac7a537e2d6714
commit ffe8f53f9cc73fb25c8f78d4aed7ddf285503a60 upstream.
Commit c0c0d9eeeb8d ("drm/msm: hdmi audio support") uses logical
OR operators to build up a value to be written in the
REG_HDMI_AUDIO_INFO0 and REG_HDMI_AUDIO_INFO1 registers when it
should have used bitwise operators.
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Fixes: c0c0d9eeeb8d ("drm/msm: hdmi audio support")
Signed-off-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drm/msm: protect against faults from copy_from_user() in submit ioctl2016-11-20T01:17:19+00:00Rob Clarkrobdclark@gmail.com2016-08-22T19:28:38+00:00urn:sha1:1cc8a445b03b92080db94c268abe2bdbbcd95257
commit d78d383ab354b0b9e1d23404ae0d9fbdeb9aa035 upstream.
An evil userspace could try to cause deadlock by passing an unfaulted-in
GEM bo as submit->bos (or submit->cmds) table. Which will trigger
msm_gem_fault() while we already hold struct_mutex. See:
https://github.com/freedreno/msmtest/blob/master/evilsubmittest.c
Signed-off-by: Rob Clark <robdclark@gmail.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drm/msm: fix use of copy_from_user() while holding spinlock2016-11-20T01:17:19+00:00Rob Clarkrobdclark@gmail.com2016-08-22T19:15:23+00:00urn:sha1:b7ba904bad346d696713970413ac97c3f7fb8215
commit 89f82cbb0d5c0ab768c8d02914188aa2211cd2e3 upstream.
Use instead __copy_from_user_inatomic() and fallback to slow-path where
we drop and re-aquire the lock in case of fault.
Reported-by: Vaishali Thakkar <vaishali.thakkar@oracle.com>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drm/msm: use mutex_lock_interruptible for submit ioctl2016-11-20T01:17:19+00:00Rob Clarkrobdclark@gmail.com2016-05-17T19:43:35+00:00urn:sha1:cc5fdd0cc3ed004df9f15f5ce3c9f2432fc037c5
commit b5b4c264df4d270819676b290cef9a11d04c35f0 upstream.
Be kinder to things that do lots of signal handling (ie. Xorg)
Signed-off-by: Rob Clark <robdclark@gmail.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drm/msm: fix IOMMU cleanup for -EPROBE_DEFER2014-06-22T12:32:10+00:00Stephane Viausviau@codeaurora.org2014-06-17T14:32:37+00:00urn:sha1:87e956e9be0cdb832e90a4731b620286a8826842
If probe fails after IOMMU is attached, we need to detach in order to
clean up properly. Before this change, IOMMU faults would occur if the
probe failed (-EPROBE_DEFER).
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
drm/msm: use PAGE_ALIGNED instead of IS_ALIGNED(PAGE_SIZE)2014-06-22T12:32:10+00:00Fabian Frederickfabf@skynet.be2014-06-14T22:24:26+00:00urn:sha1:cf3198c2051a180d0cb469b275b2fb30a0533772
use mm.h definition
Cc: David Airlie <airlied@linux.ie>
Cc: Rob Clark <robdclark@gmail.com>
Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: Rob Clark <robdclark@gmail.com>
drm/msm/hdmi: set hdp clock rate before prepare_enable2014-06-22T12:32:09+00:00Stephane Viausviau@codeaurora.org2014-06-06T14:03:32+00:00urn:sha1:b77f47e78982807286f6fdb4c39f9e798606dace
The clock driver usually complains when a clock is being prepared
before setting its rate. It is the case here for "core_clk" which
needs to be set at 19.2 MHz before we attempt a prepare_enable().
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
drm/msm: storage class should be before const qualifier2014-06-22T12:32:09+00:00Peter Griffinpeter.griffin@linaro.org2014-06-05T17:30:58+00:00urn:sha1:370a4d8a79f166d2accc294c4db35e5cbe8c3a90
The C99 specification states in section 6.11.5:
The placement of a storage-class specifier other than at the beginning
of the declaration specifiers in a declaration is an obsolescent
feature.
Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Cc: David Airlie <airlied@linux.ie>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Rob Clark <robdclark@gmail.com>