<feed xmlns='http://www.w3.org/2005/Atom'>
<title>kernel/linux.git/drivers/gpu/drm/vmwgfx, branch linux-4.20.y</title>
<subtitle>Linux kernel stable tree (mirror)</subtitle>
<id>https://git.radix-linux.su/kernel/linux.git/atom?h=linux-4.20.y</id>
<link rel='self' href='https://git.radix-linux.su/kernel/linux.git/atom?h=linux-4.20.y'/>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/'/>
<updated>2019-02-15T07:11:06+00:00</updated>
<entry>
<title>drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user</title>
<updated>2019-02-15T07:11:06+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2019-01-31T09:55:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=547dd71ca4d746a727116fd4e597bbd3da4c6cc2'/>
<id>urn:sha1:547dd71ca4d746a727116fd4e597bbd3da4c6cc2</id>
<content type='text'>
commit 728354c005c36eaf44b6e5552372b67e60d17f56 upstream.

The function was unconditionally returning 0, and a caller would have to
rely on the returned fence pointer being NULL to detect errors. However,
the function vmw_execbuf_copy_fence_user() would expect a non-zero error
code in that case and would BUG otherwise.

So make sure we return a proper non-zero error code if the fence pointer
returned is NULL.

Cc: &lt;stable@vger.kernel.org&gt;
Fixes: ae2a104058e2: ("vmwgfx: Implement fence objects")
Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Deepak Rawat &lt;drawat@vmware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
</entry>
<entry>
<title>drm/vmwgfx: Fix an uninitialized fence handle value</title>
<updated>2019-02-15T07:11:06+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2019-01-31T09:52:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=0075a47478001ca4e10dd649b2d39c1ddb74b465'/>
<id>urn:sha1:0075a47478001ca4e10dd649b2d39c1ddb74b465</id>
<content type='text'>
commit 51fdbeb4ca1a8415c98f87cb877956ae83e71627 upstream.

if vmw_execbuf_fence_commands() fails, The handle value will be
uninitialized and a bogus fence handle might be copied to user-space.

Cc: &lt;stable@vger.kernel.org&gt;
Fixes: 2724b2d54cda: ("drm/vmwgfx: Use new validation interface for the modesetting code v2")
Reported-by: Dan Carpenter &lt;dan.carpenter@oracle.com&gt;
Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Brian Paul &lt;brianp@vmware.com&gt; #v1
Reviewed-by: Sinclair Yeh &lt;syeh@vmware.com&gt; #v1
Reviewed-by: Deepak Rawat &lt;drawat@vmware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
</entry>
<entry>
<title>drm/vmwgfx: Fix setting of dma masks</title>
<updated>2019-02-15T07:11:06+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2019-01-28T09:31:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=64d569f5693098dae72619df75c65021877f2660'/>
<id>urn:sha1:64d569f5693098dae72619df75c65021877f2660</id>
<content type='text'>
commit 4cbfa1e6c09e98450aab3240e5119b0ab2c9795b upstream.

Previously we set only the dma mask and not the coherent mask. Fix that.
Also, for clarity, make sure both are initially set to 64 bits.

Cc: &lt;stable@vger.kernel.org&gt;
Fixes: 0d00c488f3de: ("drm/vmwgfx: Fix the driver for large dma addresses")
Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Deepak Rawat &lt;drawat@vmware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
</entry>
<entry>
<title>drm/vmwgfx: Protect from excessive execbuf kernel memory allocations v3</title>
<updated>2018-12-13T12:04:25+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2018-12-12T10:52:08+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=fd567467753fac9f9f477550065018e7f4e3c8f3'/>
<id>urn:sha1:fd567467753fac9f9f477550065018e7f4e3c8f3</id>
<content type='text'>
With the new validation code, a malicious user-space app could
potentially submit command streams with enough buffer-object and resource
references in them to have the resulting allocated validion nodes and
relocations make the kernel run out of GFP_KERNEL memory.

Protect from this by having the validation code reserve TTM graphics
memory when allocating.

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Deepak Rawat &lt;drawat@vmware.com&gt;
---
v2: Removed leftover debug printouts
</content>
</entry>
<entry>
<title>drm/vmwgfx: remove redundant return ret statement</title>
<updated>2018-12-12T11:01:05+00:00</updated>
<author>
<name>Colin Ian King</name>
<email>colin.king@canonical.com</email>
</author>
<published>2018-10-04T17:49:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=e06d45d8c165a0b1a7aaa1b794c78d2db911c8f6'/>
<id>urn:sha1:e06d45d8c165a0b1a7aaa1b794c78d2db911c8f6</id>
<content type='text'>
The return statement is redundant as there is a return statement
immediately before it so we have dead code that can be removed.
Also remove the unused declaration of ret.

Detected by CoverityScan, CID#1473793 ("Structurally dead code")

Signed-off-by: Colin Ian King &lt;colin.king@canonical.com&gt;
Reviewed-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
</content>
</entry>
<entry>
<title>Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next</title>
<updated>2018-10-04T00:19:33+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2018-10-04T00:19:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=d04a836ea76c49db8c5547612d9c9cbb97f0402d'/>
<id>urn:sha1:d04a836ea76c49db8c5547612d9c9cbb97f0402d</id>
<content type='text'>
Mostly code reorganizations and optimizations for vmwgfx.
- Move TTM code that's only used by vmwgfx to vmwgfx
- Break out the vmwgfx buffer- and resource validation code to a separate source file
- Get rid of a number of atomic operations during command buffer validation.

From: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20180928131157.2810-1-thellstrom@vmware.com
</content>
</entry>
<entry>
<title>drm/vmwgfx: Make user resource lookups reference-free during validation</title>
<updated>2018-09-28T06:57:09+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2018-09-26T14:32:40+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=e8c66efbfe3a2e3cbc573f2474a3d51690f1b857'/>
<id>urn:sha1:e8c66efbfe3a2e3cbc573f2474a3d51690f1b857</id>
<content type='text'>
Make the process of looking up a user resource and adding it to the
validation list reference-free unless when it's actually added to the
validation list where a single reference is taken.
This saves two locked atomic operations per command stream buffer object
handle lookup, unless there is a lookup cache hit.

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Sinclair Yeh &lt;syeh@vmware.com&gt;
</content>
</entry>
<entry>
<title>drm/vmwgfx: Don't refcount cotable lookups during command buffer validation</title>
<updated>2018-09-28T06:57:08+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2018-09-26T14:29:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=1b9a01d62cb1bed2bc98f8b4e31d5b9daf0a446b'/>
<id>urn:sha1:1b9a01d62cb1bed2bc98f8b4e31d5b9daf0a446b</id>
<content type='text'>
The typical pattern of these lookups are
-Lookup
-Put on validate list if not already there.
-Unreference
And since we are the exclusive user of the context during lookup time,
we can be sure that the resource will stay alive during the sequence.
So avoid taking a reference during lookup, and also avoid unreferencing
when done. There are two users outside of command buffer validation and
those are refcounted explicitly.

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Sinclair Yeh &lt;syeh@vmware.com&gt;
</content>
</entry>
<entry>
<title>drm/vmwgfx: Don't refcount command-buffer managed resource lookups during command buffer validation</title>
<updated>2018-09-28T06:57:08+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2018-09-26T14:28:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=508108ea274788888408f4245438e40c90d821da'/>
<id>urn:sha1:508108ea274788888408f4245438e40c90d821da</id>
<content type='text'>
The typical pattern of these lookups are
-Lookup
-Put on validate list if not already there.
-Unreference
And since we are the exclusive user of the context during lookup time,
we can be sure that the resource will stay alive during the sequence.
So avoid taking a reference during lookup, and also avoid unreferencing
when done.

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Sinclair Yeh &lt;syeh@vmware.com&gt;
</content>
</entry>
<entry>
<title>drm/vmwgfx: Make buffer object lookups reference-free during validation</title>
<updated>2018-09-28T06:57:08+00:00</updated>
<author>
<name>Thomas Hellstrom</name>
<email>thellstrom@vmware.com</email>
</author>
<published>2018-09-26T14:27:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=b139d43dacef688a4f46f29eef34409e950f7cef'/>
<id>urn:sha1:b139d43dacef688a4f46f29eef34409e950f7cef</id>
<content type='text'>
Make the process of looking up a buffer object and adding it to the
validation list reference-free unless when it's actually added to the
validation list where a single reference is taken.
This saves two locked atomic operations per command stream buffer object
handle lookup.

Signed-off-by: Thomas Hellstrom &lt;thellstrom@vmware.com&gt;
Reviewed-by: Sinclair Yeh &lt;syeh@vmware.com&gt;
</content>
</entry>
</feed>
