linux-toradex.git/drivers/gpu/drm/vmwgfx, branch v4.4.85

drm/vmwgfx: Fix gcc-7.1.1 warning

2017-08-07T02:19:39+00:00

commit fcfffdd8f98ac305285dca568b5065ef86be6458 upstream.

The current code does not look correct, and the reason for it is
probably lost.  Since this now generates a compiler warning,
fix it to what makes sense.

Reported-by: Arnd Bergmann 
Reported-by: Linus Torvalds 
Signed-off-by: Sinclair Yeh 
Reviewed-by: Brian Paul 
Signed-off-by: Greg Kroah-Hartman

drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr

2017-07-05T12:37:16+00:00

commit 82fcee526ba8ca2c5d378bdf51b21b7eb058fe3a upstream.

The hash table created during vmw_cmdbuf_res_man_create was
never freed. This causes memory leak in context creation.
Added the corresponding drm_ht_remove in vmw_cmdbuf_res_man_destroy.

Tested for memory leak by running piglit overnight and kernel
memory is not inflated which earlier was.

Signed-off-by: Deepak Rawat 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Thomas Hellstrom 
Signed-off-by: Greg Kroah-Hartman

drm/vmwgfx: Make sure backup_handle is always valid

2017-06-14T11:16:25+00:00

commit 07678eca2cf9c9a18584e546c2b2a0d0c9a3150c upstream.

When vmw_gb_surface_define_ioctl() is called with an existing buffer,
we end up returning an uninitialized variable in the backup_handle.

The fix is to first initialize backup_handle to 0 just to be sure, and
second, when a user-provided buffer is found, we will use the
req->buffer_handle as the backup_handle.

Reported-by: Murray McAllister 
Signed-off-by: Sinclair Yeh 
Reviewed-by: Deepak Rawat 
Signed-off-by: Greg Kroah-Hartman

drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()

2017-06-14T11:16:25+00:00

commit ee9c4e681ec4f58e42a83cb0c22a0289ade1aacf upstream.

The 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is
a user-controlled 'uint32_t' value which is used as a loop count limit.
This can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1437431

Signed-off-by: Vladis Dronov 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Greg Kroah-Hartman

drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()

2017-06-14T11:16:25+00:00

commit f0c62e9878024300319ba2438adc7b06c6b9c448 upstream.

If vmalloc() fails then we need to a bit of cleanup before returning.

Fixes: fb1d9738ca05 ("drm/vmwgfx: Add DRM driver for VMware Virtual GPU")
Signed-off-by: Dan Carpenter 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Greg Kroah-Hartman

drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()

2017-04-12T10:38:33+00:00

commit e7e11f99564222d82f0ce84bd521e57d78a6b678 upstream.

In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the
'req->mip_levels' array. This array can be assigned any value from
the user space. As both the 'num_sizes' and the array is uint32_t,
it is easy to make 'num_sizes' overflow. The later 'mip_levels' is
used as the loop count. This can lead an oob write. Add the check of
'req->mip_levels' to avoid this.

Signed-off-by: Li Qiang 
Reviewed-by: Thomas Hellstrom 
Signed-off-by: Greg Kroah-Hartman

drm/vmwgfx: Remove getparam error message

2017-04-12T10:38:33+00:00

commit 53e16798b0864464c5444a204e1bb93ae246c429 upstream.

The mesa winsys sometimes uses unimplemented parameter requests to
check for features. Remove the error message to avoid bloating the
kernel log.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Brian Paul 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Greg Kroah-Hartman

drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces

2017-04-12T10:38:33+00:00

commit fe25deb7737ce6c0879ccf79c99fa1221d428bf2 upstream.

Previously, when a surface was opened using a legacy (non prime) handle,
it was verified to have been created by a client in the same master realm.
Relax this so that opening is also allowed recursively if the client
already has the surface open.

This works around a regression in svga mesa where opening of a shared
surface is used recursively to obtain surface information.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Greg Kroah-Hartman

drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()

2017-04-12T10:38:32+00:00

commit 63774069d9527a1aeaa4aa20e929ef5e8e9ecc38 upstream.

In vmw_get_cap_3d_ioctl(), a user can supply 0 for a size that is
used in vzalloc(). This eventually calls dump_stack() (in warn_alloc()),
which can leak useful addresses to dmesg.

Add check to avoid a size of 0.

Signed-off-by: Murray McAllister 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Greg Kroah-Hartman

drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()

2017-04-12T10:38:32+00:00

commit 36274ab8c596f1240c606bb514da329add2a1bcd upstream.

Before memory allocations vmw_surface_define_ioctl() checks the
upper-bounds of a user-supplied size, but does not check if the
supplied size is 0.

Add check to avoid NULL pointer dereferences.

Signed-off-by: Murray McAllister 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Greg Kroah-Hartman