summaryrefslogtreecommitdiff
path: root/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
AgeCommit message (Collapse)AuthorFilesLines
2019-09-16drm/vmwgfx: Fix double free in vmw_recv_msg()Dan Carpenter1-5/+3
commit 08b0c891605acf727e43e3e03a25857d3e789b61 upstream. We recently added a kfree() after the end of the loop: if (retries == RETRIES) { kfree(reply); return -EINVAL; } There are two problems. First the test is wrong and because retries equals RETRIES if we succeed on the last iteration through the loop. Second if we fail on the last iteration through the loop then the kfree is a double free. When you're reading this code, please note the break statement at the end of the while loop. This patch changes the loop so that if it's not successful then "reply" is NULL and we can test for that afterward. Cc: <stable@vger.kernel.org> Fixes: 6b7c3b86f0b6 ("drm/vmwgfx: fix memory leak when too many retries have occurred") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-08-29drm/vmwgfx: fix memory leak when too many retries have occurredColin Ian King1-1/+3
[ Upstream commit 6b7c3b86f0b63134b2ab56508921a0853ffa687a ] Currently when too many retries have occurred there is a memory leak on the allocation for reply on the error return path. Fix this by kfree'ing reply before returning. Addresses-Coverity: ("Resource leak") Fixes: a9cd9c044aa9 ("drm/vmwgfx: Add a check to handle host message failure") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Deepak Rawat <drawat@vmware.com> Signed-off-by: Deepak Rawat <drawat@vmware.com> Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2017-07-24Merge branch 'drm-vmwgfx-fixes' of ↵Dave Airlie1-3/+3
git://people.freedesktop.org/~syeh/repos_linux into drm-fixes misc vmwgfx fixes. * 'drm-vmwgfx-fixes' of git://people.freedesktop.org/~syeh/repos_linux: drm/vmwgfx: constify pci_device_id. drm/vmwgfx: Fix gcc-7.1.1 warning drm/vmwgfx: Fix cursor hotspot issue with Wayland on Fedora drm/vmwgfx: Limit max desktop dimensions to 8Kx8K drm/vmwgfx: dma-buf: Constify ttm_place structures. drm/vmwgfx: fix comment mistake for vmw_cmd_dx_set_index_buffer() drm/vmwgfx: Use dma_pool_zalloc drm/vmwgfx: Fix handling of errors returned by 'vmw_cotable_alloc()' drm/vmwgfx: Fix NULL pointer comparison
2017-07-18drm/vmwgfx: Fix NULL pointer comparisonRavikant B Sharma1-3/+3
Replace direct comparisons to NULL i.e. 'x == NULL' with '!x'. As per coding standard. Signed-off-by: Ravikant B Sharma <ravikant.s2@samsung.com> Reviewed-by: Sinclair Yeh <syeh@vmware.com> Signed-off-by: Sinclair Yeh <syeh@vmware.com>
2017-05-18drm/vmwgfx: fix include notation and remove -Iinclude/drm flagMasahiro Yamada1-1/+1
Include <drm/*.h> instead of relative path from include/drm, then remove the -Iinclude/drm compiler flag. Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/1493009447-31524-18-git-send-email-yamada.masahiro@socionext.com
2016-07-01drm/vmwgfx: Add a check to handle host message failureSinclair Yeh1-0/+3
Discovered by static code analysis tool. If for some reason communication with the host fails more than preset number of retries, return an error instead of return garbage. Signed-off-by: Sinclair Yeh <syeh@vmware.com> Reviewed-by: Charmaine Lee <charmainel@vmware.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
2016-06-08objtool, drm/vmwgfx: Fix "duplicate frame pointer save" warningJosh Poimboeuf1-1/+3
objtool reports the following warnings: drivers/gpu/drm/vmwgfx/vmwgfx_msg.o: warning: objtool: vmw_send_msg()+0x107: duplicate frame pointer save drivers/gpu/drm/vmwgfx/vmwgfx_msg.o: warning: objtool: vmw_host_get_guestinfo()+0x252: duplicate frame pointer save To quote Linus: "The reason is that VMW_PORT_HB_OUT() uses a magic instruction sequence (a "rep outsb") to communicate with the hypervisor (it's a virtual GPU driver for vmware), and %rbp is part of the communication. So the inline asm does a save-and-restore of the frame pointer around the instruction sequence. I actually find the objtool warning to be quite reasonable, so it's not exactly a false positive, since in this case it actually does point out that the frame pointer won't be reliable over that instruction sequence. But in this particular case it just ends up being the wrong thing - the code is what it is, and %rbp just can't have the frame information due to annoying magic calling conventions." Silence the warnings by telling objtool to ignore the two functions which use the VMW_PORT_HB_{IN,OUT} macros. Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: DRI <dri-devel@lists.freedesktop.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Link: http://lkml.kernel.org/r/20160526184343.fdtjjjg67smmeekt@treble Signed-off-by: Ingo Molnar <mingo@kernel.org>
2016-05-20drm/vmwgfx: Add VMWare host messaging capabilitySinclair Yeh1-0/+416
This patch adds capabilities for a VMWare guest to send and receive messages from the host, and adds functions to sending log messages to vmware.log and to request device settings that aren't available through the virtual hardware, e.g. certain settings in the VMX file. Signed-off-by: Sinclair Yeh <syeh@vmware.com> Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>