linux-toradex.git/drivers/gpu/drm/vmwgfx, branch v4.11

drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()

2017-03-30T09:46:26+00:00

In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the
'req->mip_levels' array. This array can be assigned any value from
the user space. As both the 'num_sizes' and the array is uint32_t,
it is easy to make 'num_sizes' overflow. The later 'mip_levels' is
used as the loop count. This can lead an oob write. Add the check of
'req->mip_levels' to avoid this.

Cc: 
Signed-off-by: Li Qiang 
Reviewed-by: Thomas Hellstrom

drm/vmwgfx: Remove getparam error message

2017-03-30T09:43:40+00:00

The mesa winsys sometimes uses unimplemented parameter requests to
check for features. Remove the error message to avoid bloating the
kernel log.

Cc: 
Signed-off-by: Thomas Hellstrom 
Reviewed-by: Brian Paul 
Reviewed-by: Sinclair Yeh

drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces

2017-03-30T09:43:39+00:00

Previously, when a surface was opened using a legacy (non prime) handle,
it was verified to have been created by a client in the same master realm.
Relax this so that opening is also allowed recursively if the client
already has the surface open.

This works around a regression in svga mesa where opening of a shared
surface is used recursively to obtain surface information.

Cc: 
Signed-off-by: Thomas Hellstrom 
Reviewed-by: Sinclair Yeh

drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()

2017-03-30T09:43:37+00:00

In vmw_get_cap_3d_ioctl(), a user can supply 0 for a size that is
used in vzalloc(). This eventually calls dump_stack() (in warn_alloc()),
which can leak useful addresses to dmesg.

Add check to avoid a size of 0.

Cc: 
Signed-off-by: Murray McAllister 
Reviewed-by: Sinclair Yeh

drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()

2017-03-30T09:43:23+00:00

Before memory allocations vmw_surface_define_ioctl() checks the
upper-bounds of a user-supplied size, but does not check if the
supplied size is 0.

Add check to avoid NULL pointer dereferences.

Cc: 
Signed-off-by: Murray McAllister 
Reviewed-by: Sinclair Yeh

drm/vmwgfx: Type-check lookups of fence objects

2017-03-30T09:42:54+00:00

A malicious caller could otherwise hand over handles to other objects
causing all sorts of interesting problems.

Testing done: Ran a Fedora 25 desktop using both Xorg and
gnome-shell/Wayland.

Cc: 
Signed-off-by: Thomas Hellstrom 
Reviewed-by: Sinclair Yeh

drm/vmwgfx: Work around drm removal of control nodes

2017-02-26T21:52:28+00:00

vmware tools has a daemon that gets layout information from the GUI and
forwards it to DRM so that the modesetting code can set preferred connector
locations and modes. This daemon was using control nodes but since control
nodes were just removed, make it possible for the daemon to use render- or
primary nodes instead. This is a bit ugly but will allow drm to proceed with
removal of the mostly unused control-node code and allow vmware to proceed
with fixing up automatic layout settings for gnome-shell/wayland.

We bump minor to inform user-space about the api change.

Cc: 
Signed-off-by: Thomas Hellstrom 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Daniel Vetter 
Link: http://patchwork.freedesktop.org/patch/msgid/20170221104227.2854-1-thellstrom@vmware.com

drm: Improve drm_mm search (and fix topdown allocation) with rbtrees

2017-02-03T10:10:32+00:00

The drm_mm range manager claimed to support top-down insertion, but it
was neither searching for the top-most hole that could fit the
allocation request nor fitting the request to the hole correctly.

In order to search the range efficiently, we create a secondary index
for the holes using either their size or their address. This index
allows us to find the smallest hole or the hole at the bottom or top of
the range efficiently, whilst keeping the hole stack to rapidly service
evictions.

v2: Search for holes both high and low. Rename flags to mode.
v3: Discover rb_entry_safe() and use it!
v4: Kerneldoc for enum drm_mm_insert_mode.

Signed-off-by: Chris Wilson 
Reviewed-by: Joonas Lahtinen 
Cc: Alex Deucher 
Cc: "Christian König" 
Cc: David Airlie 
Cc: Russell King 
Cc: Daniel Vetter 
Cc: Jani Nikula 
Cc: Sean Paul 
Cc: Lucas Stach 
Cc: Christian Gmeiner 
Cc: Rob Clark 
Cc: Thierry Reding 
Cc: Stephen Warren 
Cc: Alexandre Courbot 
Cc: Eric Anholt 
Cc: Sinclair Yeh 
Cc: Thomas Hellstrom 
Reviewed-by: Alex Deucher 
Reviewed-by: Sinclair Yeh  # vmwgfx
Reviewed-by: Lucas Stach  #etnaviv
Signed-off-by: Daniel Vetter 
Link: http://patchwork.freedesktop.org/patch/msgid/20170202210438.28702-1-chris@chris-wilson.co.uk

Merge branch 'drm-vmwgfx-next' of git://people.freedesktop.org/~syeh/repos_linux into drm-next

2017-01-31T22:40:13+00:00

This is to address what we've discussed, moving some of the minor changes
into a drm-next request.

* 'drm-vmwgfx-next' of git://people.freedesktop.org/~syeh/repos_linux:
  drm/vmwgfx: Use kmemdup instead of kmalloc and memcpy
  drm/vmwgfx: Fix depth input into drm_mode_legacy_fb_format
  drm/vmwgfx: Fix a potential integer overflow
  drm/vmwgfx: Clear an uninitialized struct member
  drm/vmwgfx: Annotate ignored return values
  drm/vmwgfx: Clear uninitialized fields of a parameter

drm/ttm: revert "implement LRU add callbacks v2"

2017-01-27T17:20:34+00:00

The additional housekeeping had too much CPU overhead,
let's use the BO priorities instead.

agd: also revert hibmc changes

Reviewed-by: Sinclair Yeh 
Signed-off-by: Christian König 
Reviewed-and-Tested-by: Roger.He 
Signed-off-by: Alex Deucher