kernel/linux.git/drivers/gpu/drm/vgem, branch v4.14.152

drm/vgem: fix use-after-free when drm_gem_handle_create() fails

2019-04-03T04:25:19+00:00

commit 21d2b122732318b48c10b7262e15595ce54511d3 upstream. If drm_gem_handle_create() fails in vgem_gem_create(), then the drm_vgem_gem_object is freed twice: once when the reference is dropped by drm_gem_object_put_unlocked(), and again by __vgem_gem_destroy(). This was hit by syzkaller using fault injection. Fix it by skipping the second free. Reported-by: syzbot+e73f2fb5ed5a5df36d33@syzkaller.appspotmail.com Fixes: af33a9190d02 ("drm/vgem: Enable dmabuf import interfaces") Reviewed-by: Chris Wilson Cc: Laura Abbott Cc: Daniel Vetter Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Acked-by: Laura Abbott Signed-off-by: Rodrigo Siqueira Link: https://patchwork.freedesktop.org/patch/msgid/20190226214451.195123-1-ebiggers@kernel.org Signed-off-by: Maxime Ripard Signed-off-by: Greg Kroah-Hartman

drm/vgem: Fix vgem_init to get drm device available.

2019-02-12T18:45:56+00:00

[ Upstream commit d5c04dff24870ef07ce6453a3f4e1ffd9cf88d27 ] Modify vgem_init to take platform dev as parent in drm_dev_init. This will make drm device available at "/sys/devices/platform/vgem" in x86 chromebook. v2: rebase, address checkpatch typo and line over 80 characters Cc: Daniel Vetter Signed-off-by: Deepak Sharma Reviewed-by: Sean Paul Signed-off-by: Emil Velikov Reviewed-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20181023163550.15211-1-emil.l.velikov@gmail.com Signed-off-by: Sasha Levin

drm/vgem: switch to drm__get(), drm__put() helpers

2017-08-11T15:41:43+00:00

Use drm_*_get() and drm_*_put() helpers instead of drm_*_reference() and drm_*_unreference() helpers. drm_*_reference() and drm_*_unreference() functions are just compatibility alias for drm_*_get() and drm_*_put() and should not be used by new code. So convert all users of compatibility functions to use the new APIs. Generated by: scripts/coccinelle/api/drm-get-put.cocci Signed-off-by: Cihangir Akturk Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/1502454794-28558-26-git-send-email-cakturk@gmail.com

drm/vgem: add compat_ioctl support

2017-07-17T19:08:31+00:00

DRM drivers should supply a compat version if they're going to provide an ioctl implementation at all. This can confuse 32-bit user space on a 64-bit system. Signed-off-by: Brian Norris Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20170715031212.108695-1-briannorris@chromium.org

drm/vgem: Pin our pages for dmabuf exports

2017-06-23T11:04:22+00:00

When the caller maps their dmabuf and we return an sg_table, the caller doesn't expect the pages beneath that sg_table to vanish on a whim (i.e. under mempressure). The contract is that the pages are pinned for the duration of the mapping (from dma_buf_map_attachment() to dma_buf_unmap_attachment). To comply, we need to introduce our own vgem_object.pages_pin_count and elevate it across the mapping. However, the drm_prime interface we use calls drv->prime_pin on dma_buf_attach and drv->prime_unpin on dma_buf_detach, which while that does cover the mapping is much broader than is desired -- but it will do for now. v2: also hold the pin across prime_vmap/vunmap Reported-by: Tomi Sarvela Testcase: igt/gem_concurrent_blit/*swap*vgem* Fixes: 5ba6c9ff961a ("drm/vgem: Fix mmaping") Signed-off-by: Chris Wilson Cc: Tomi Sarvela Cc: Laura Abbott Cc: Sean Paul Cc: Matthew Auld Cc: Daniel Vetter Cc: # needs a backport Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20170622134617.17912-1-chris@chris-wilson.co.uk

drm/vgem: Fix return value check in vgem_init()

2017-05-22T07:47:34+00:00

In case of error, the function platform_device_register_simple() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Fixes: af33a9190d02 ("drm/vgem: Enable dmabuf import interfaces") Signed-off-by: Wei Yongjun Reviewed-by: Chris Wilson [danvet: Fix fixes: tag per Chris' review.] Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20170521011939.8111-1-weiyj.lk@gmail.com

drm: drop drm_[cm]alloc* helpers

2017-05-18T15:22:39+00:00

Now that drm_[cm]alloc* helpers are simple one line wrappers around kvmalloc_array and drm_free_large is just kvfree alias we can drop them and replace by their native forms. This shouldn't introduce any functional change. Changes since v1 - fix typo in drivers/gpu//drm/etnaviv/etnaviv_gem.c - noticed by 0day build robot Suggested-by: Daniel Vetter Signed-off-by: Michal Hocko drm: drop drm_[cm]alloc* helpers [danvet: Fixup vgem which grew another user very recently.] Signed-off-by: Daniel Vetter Acked-by: Christian König Link: http://patchwork.freedesktop.org/patch/msgid/20170517122312.GK18247@dhcp22.suse.cz

drm/vgem: remove unneeded -Iinclude/drm compiler flag

2017-05-18T05:13:59+00:00

With the include directives under include/drm/ fixed, this flag is no longer needed. Signed-off-by: Masahiro Yamada Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1493009447-31524-29-git-send-email-yamada.masahiro@socionext.com

drm/vgem: Convert to a struct drm_device subclass

2017-05-10T08:14:06+00:00

With Laura's introduction of the fake platform device for importing dmabuf, we add a second static that is logically tied to the vgem_device. Convert vgem over to using the struct drm_device subclassing, so that the platform device is stored inside its owner. Signed-off-by: Chris Wilson Cc: Laura Abbott Cc: Daniel Vetter Reviewed-by: Laura Abbott Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20170508132228.9509-1-chris@chris-wilson.co.uk

drm/vgem: Enable dmabuf import interfaces

2017-05-08T07:39:13+00:00

Enable the GEM dma-buf import interfaces in addition to the export interfaces. This lets vgem be used as a test source for other allocators (e.g. Ion). Reviewed-by: Chris Wilson Signed-off-by: Laura Abbott Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1493923548-20878-4-git-send-email-labbott@redhat.com