kernel/linux.git/drivers/gpu/drm/virtio/virtgpu_ioctl.c, branch v5.15.215

drm/virtio: Fix GEM handle creation UAF

2023-01-18T10:48:49+00:00

commit 52531258318ed59a2dc5a43df2eaf0eb1d65438e upstream. Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done *after* we are done dereferencing the object. Signed-off-by: Rob Clark Reviewed-by: Chia-I Wu Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Osipenko Link: https://patchwork.freedesktop.org/patch/msgid/20221216233355.542197-2-robdclark@gmail.com Signed-off-by: Greg Kroah-Hartman

virtio-gpu: fix a missing check to avoid NULL dereference

2022-08-17T12:23:18+00:00

[ Upstream commit bd63f11f4c3c46afec07d821f74736161ff6e526 ] 'cache_ent' could be set NULL inside virtio_gpu_cmd_get_capset() and it will lead to a NULL dereference by a lately use of it (i.e., ptr = cache_ent->caps_cache). Fix it with a NULL check. Fixes: 62fb7a5e10962 ("virtio-gpu: add 3d/virgl support") Signed-off-by: Xiaomeng Tong Reviewed-by: Chia-I Wu Link: http://patchwork.freedesktop.org/patch/msgid/20220327050945.1614-1-xiam0nd.tong@gmail.com [ kraxel: minor codestyle fixup ] Signed-off-by: Gerd Hoffmann Signed-off-by: Sasha Levin

dma-buf: drop the _rcu postfix on function names v3

2021-06-06T09:19:51+00:00

The functions can be called both in _rcu context as well as while holding the lock. v2: add some kerneldoc as suggested by Daniel v3: fix indentation Signed-off-by: Christian König Reviewed-by: Jason Ekstrand Acked-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20210602111714.212426-7-christian.koenig@amd.com

drm/virtio: fix possible leak/unlock virtio_gpu_object_array

2021-03-09T11:06:18+00:00

virtio_gpu_object array is not freed or unlocked in some failed cases. Signed-off-by: xndcn Link: http://patchwork.freedesktop.org/patch/msgid/20210305151819.14330-1-xndchn@gmail.com Signed-off-by: Gerd Hoffmann

drm/virtio: suffix create blob call with _ioctl like any ioctl

2020-11-20T09:44:41+00:00

For coherency, all ioctls are suffixed Signed-off-by: Anthoine Bourgeois Link: http://patchwork.freedesktop.org/patch/msgid/20201119010809.528-1-gurchetansingh@chromium.org Signed-off-by: Gerd Hoffmann

drm/virtio: advertise features to userspace

2020-09-29T09:23:57+00:00

New api changes are now available to userspace. Also, the comparison to true is redundant, so remove it. Signed-off-by: Gurchetan Singh Acked-by: Tomeu Vizoso Link: http://patchwork.freedesktop.org/patch/msgid/20200924003214.662-19-gurchetansingh@chromium.org Signed-off-by: Gerd Hoffmann

drm/virtio: implement blob resources: resource create blob ioctl

2020-09-29T09:23:51+00:00

Implement resource create blob as specified. Signed-off-by: Gerd Hoffmann Acked-by: Tomeu Vizoso Link: http://patchwork.freedesktop.org/patch/msgid/20200924003214.662-18-gurchetansingh@chromium.org Co-developed-by: Gurchetan Singh Signed-off-by: Gurchetan Singh

drm/virtio: implement blob resources: report blob mem to userspace

2020-09-29T09:23:49+00:00

The stride field has never been used, so repurpose it to be "blob_mem". This way, userspace can know the memory properties of the blob if it's passed between userspace processes and no suitable userspace API exists to transmit that knowledge. Signed-off-by: Gurchetan Singh Acked-by: Tomeu Vizoso Link: http://patchwork.freedesktop.org/patch/msgid/20200924003214.662-17-gurchetansingh@chromium.org Signed-off-by: Gerd Hoffmann

drm/virtio: implement blob resources: fix stride discrepancy

2020-09-29T09:23:47+00:00

The old transfer ioctls may work on blob resources, and there is no TRANSFER_BLOB hypercall now for simplicity. The guest may have a image view on the blob resources such that the stride is not equal to width * bytes_per_pixel. For host-only blobs, we can repurpose the transfer ioctls to synchronize caches as well. For guest-only blobs, these operations are undefined for now so leave them out. Also, with seamless Wayland integration between guest/host looking increasingly attractive, it also makes sense to keep track of one value for stride. Signed-off-by: Gurchetan Singh Acked-by: Tomeu Vizoso Link: http://patchwork.freedesktop.org/patch/msgid/20200924003214.662-16-gurchetansingh@chromium.org Signed-off-by: Gerd Hoffmann

Merge tag 'drm-misc-fixes-2020-08-12' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

2020-08-19T03:54:42+00:00

drm-misc-fixes for v5.9-rc1: - Add missing dma_fence_put() in virtio_gpu_execbuffer_ioctl(). - Fix memory leak in virtio_gpu_cleanup_object(). Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/d50eb2e0-75c8-b724-006f-5e7b391961ff@linux.intel.com