kernel/linux.git/drivers/gpu/drm/msm, branch v3.16.61

drm/msm: Fix possible null dereference on failure of get_pages()

2018-10-21T07:45:32+00:00

commit 3976626ea3d2011f8fd3f3a47070a8b792018253 upstream. Commit 62e3a3e342af changed get_pages() to initialise msm_gem_object::pages before trying to initialise msm_gem_object::sgt, so that put_pages() would properly clean up pages in the failure case. However, this means that put_pages() now needs to check that msm_gem_object::sgt is not null before trying to clean it up, and this check was only applied to part of the cleanup code. Move it all into the conditional block. (Strictly speaking we don't need to make the kfree() conditional, but since we can't avoid checking for null ourselves we may as well do so.) Fixes: 62e3a3e342af ("drm/msm: fix leak in failed get_pages") Signed-off-by: Ben Hutchings Reviewed-by: Jordan Crouse Signed-off-by: Rob Clark Signed-off-by: Ben Hutchings

drm/msm: fix leak in failed get_pages

2018-10-21T07:45:32+00:00

commit 62e3a3e342af3c313ab38603811ecdb1fcc79edb upstream. get_pages doesn't keep a reference of the pages allocated when it fails later in the code path. This can lead to a memory leak. Keep reference of the allocated pages so that it can be freed when msm_gem_free_object gets called later during cleanup. Signed-off-by: Prakash Kamliya Signed-off-by: Sharat Masetty Signed-off-by: Rob Clark Signed-off-by: Ben Hutchings

drm/msm: fix an integer overflow test

2017-11-11T13:33:13+00:00

commit 65e93108891e571f177c202add9288eda9ac4100 upstream. We recently added an integer overflow check but it needs an additional tweak to work properly on 32 bit systems. The problem is that we're doing the right hand side of the assignment as type unsigned long so the max it will have an integer overflow instead of being larger than SIZE_MAX. That means the "sz > SIZE_MAX" condition is never true even on 32 bit systems. We need to first cast it to u64 and then do the math. Fixes: 4a630fadbb29 ("drm/msm: Fix potential buffer overflow issue") Signed-off-by: Dan Carpenter Acked-by: Jordan Crouse Signed-off-by: Rob Clark [bwh: Backported to 3.16: submit_create() only supports a variable number of bos] Signed-off-by: Ben Hutchings

drm/msm: Fix potential buffer overflow issue

2017-11-11T13:33:12+00:00

commit 4a630fadbb29d9efaedb525f1a8f7449ad107641 upstream. In function submit_create, if nr_cmds or nr_bos is assigned with negative value, the allocated buffer may be small than intended. Using this buffer will lead to buffer overflow issue. Signed-off-by: Kasin Li Signed-off-by: Jordan Crouse Signed-off-by: Rob Clark [bwh: Backported to 3.16: submit_create() only supports a variable number of bos] Signed-off-by: Ben Hutchings

drm/msm/hdmi: Use bitwise operators when building register values

2017-10-12T14:27:50+00:00

commit ffe8f53f9cc73fb25c8f78d4aed7ddf285503a60 upstream. Commit c0c0d9eeeb8d ("drm/msm: hdmi audio support") uses logical OR operators to build up a value to be written in the REG_HDMI_AUDIO_INFO0 and REG_HDMI_AUDIO_INFO1 registers when it should have used bitwise operators. Signed-off-by: Liviu Dudau Fixes: c0c0d9eeeb8d ("drm/msm: hdmi audio support") Signed-off-by: Rob Clark Signed-off-by: Ben Hutchings

drm/msm: protect against faults from copy_from_user() in submit ioctl

2016-11-20T01:17:19+00:00

commit d78d383ab354b0b9e1d23404ae0d9fbdeb9aa035 upstream. An evil userspace could try to cause deadlock by passing an unfaulted-in GEM bo as submit->bos (or submit->cmds) table. Which will trigger msm_gem_fault() while we already hold struct_mutex. See: https://github.com/freedreno/msmtest/blob/master/evilsubmittest.c Signed-off-by: Rob Clark [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings

drm/msm: fix use of copy_from_user() while holding spinlock

2016-11-20T01:17:19+00:00

commit 89f82cbb0d5c0ab768c8d02914188aa2211cd2e3 upstream. Use instead __copy_from_user_inatomic() and fallback to slow-path where we drop and re-aquire the lock in case of fault. Reported-by: Vaishali Thakkar Signed-off-by: Rob Clark Signed-off-by: Ben Hutchings

drm/msm: use mutex_lock_interruptible for submit ioctl

2016-11-20T01:17:19+00:00

commit b5b4c264df4d270819676b290cef9a11d04c35f0 upstream. Be kinder to things that do lots of signal handling (ie. Xorg) Signed-off-by: Rob Clark [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings

drm/msm: fix IOMMU cleanup for -EPROBE_DEFER

2014-06-22T12:32:10+00:00

If probe fails after IOMMU is attached, we need to detach in order to clean up properly. Before this change, IOMMU faults would occur if the probe failed (-EPROBE_DEFER). Signed-off-by: Stephane Viau Signed-off-by: Rob Clark

drm/msm: use PAGE_ALIGNED instead of IS_ALIGNED(PAGE_SIZE)

2014-06-22T12:32:10+00:00

use mm.h definition Cc: David Airlie Cc: Rob Clark Signed-off-by: Fabian Frederick Signed-off-by: Rob Clark