talos-op-linux/drivers/gpu/drm/vgem, branch master

drm/vgem: Close use-after-free race in vgem_gem_create

2020-02-06T18:04:41+00:00

There's two references floating around here (for the object reference, not the handle_count reference, that's a different thing): - The temporary reference held by vgem_gem_create, acquired by creating the object and released by calling drm_gem_object_put_unlocked. - The reference held by the object handle, created by drm_gem_handle_create. This one generally outlives the function, except if a 2nd thread races with a GEM_CLOSE ioctl call. So usually everything is correct, except in that race case, where the access to gem_object->size could be looking at freed data already. Which again isn't a real problem (userspace shot its feet off already with the race, we could return garbage), but maybe someone can exploit this as an information leak. Cc: Dan Carpenter Cc: Hillf Danton Reported-by: syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Cc: Emil Velikov Cc: Daniel Vetter Cc: Sean Paul Cc: Chris Wilson Cc: Eric Anholt Cc: Sam Ravnborg Cc: Rob Clark Reviewed-by: Chris Wilson Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20200202132133.1891846-1-daniel.vetter@ffwll.ch

dma-buf: rename reservation_object to dma_resv

2019-08-13T07:09:30+00:00

Be more consistent with the naming of the other DMA-buf objects. Signed-off-by: Christian König Reviewed-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/323401/

drm/vgem: drop DRM_AUTH usage from the driver

2019-08-07T15:53:21+00:00

The authentication can be circumvented, by design, by using the render node. From the driver POV there is no distinction between primary and render nodes, thus we can drop the token. Cc: David Airlie Cc: Daniel Vetter Signed-off-by: Emil Velikov Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20190527081741.14235-11-emil.l.velikov@gmail.com

Revert "drm/vgem: drop DRM_AUTH usage from the driver"

2019-08-07T14:45:00+00:00

This reverts commit e4eee93d25776da998ec2dfaabe7d2206598d26d. Mandatory review was missing from this patch. Acked-by: Maxime Ripard Acked-by: Emil Velikov Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20190807142101.251400-4-sean@poorly.run

drm/vgem: drop use of drmP.h

2019-07-17T10:52:55+00:00

Drop use of the deprecated header drmP.h. Replace with necessary includes in the individual .c files. Signed-off-by: Sam Ravnborg Acked-by: Emil Velikov Cc: David Airlie Cc: Daniel Vetter Cc: Deepak Sharma Cc: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20190716064220.18157-13-sam@ravnborg.org

drm/vgem: Reclassify buffer creation debug message

2019-07-12T16:35:37+00:00

A buffer is created in response to the user ioctl, it should therefore be a plain DRM_DEBUG() message to reflect it being a user invoked response and not a driver construct. This is just to make the commonplace drm.debug=[26e] quieter when running with vgem. Signed-off-by: Chris Wilson Cc: Daniel Vetter Reviewed-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20190712120147.29830-1-chris@chris-wilson.co.uk

drm/vgem: drop DRM_AUTH usage from the driver

2019-06-26T14:00:40+00:00

The authentication can be circumvented, by design, by using the render node. From the driver POV there is no distinction between primary and render nodes, thus we can drop the token. Cc: David Airlie Cc: Daniel Vetter Signed-off-by: Emil Velikov Link: https://patchwork.freedesktop.org/patch/msgid/20190527081741.14235-11-emil.l.velikov@gmail.com

drm/vgem: Ditch attach trickery in the fence ioctl

2019-06-21T20:20:20+00:00

It looks like this was done purely to get a consistent place to look up the reservation object pointer. With the drm_prime.c helper code now also setting gem_object->resv for imported objects we can just use that pointer directly, instead of first ensuring a dma-buf exists. v2: Note that I screwed up the patch ordering, hence why this needed a Fixes: tag - CI spotted the broken intermediate state. Fixes: 5eab998741c8 ("drm/vgem: Drop drm_gem_prime_export") Reviewed-by: Emil Velikov Reviewed-by: Chris Wilson Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20190614203615.12639-49-daniel.vetter@ffwll.ch

drm/vgem: Drop drm_gem_prime_export

2019-06-21T18:11:38+00:00

They're the default. Aside: Would be really nice to switch the others over to drm_gem_object_funcs. Reviewed-by: Eric Anholt Reviewed-by: Emil Velikov Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20190614203615.12639-37-daniel.vetter@ffwll.ch

drm/prime: Align gem_prime_export with obj_funcs.export

2019-06-21T15:30:49+00:00

The idea is that gem_prime_export is deprecated in favor of obj_funcs.export. That's much easier to do if both have matching function signatures. Reviewed-by: Eric Anholt Reviewed-by: Emil Velikov Acked-by: Christian König Acked-by: Thierry Reding Signed-off-by: Daniel Vetter Cc: Russell King Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Sean Paul Cc: David Airlie Cc: Daniel Vetter Cc: Zhenyu Wang Cc: Zhi Wang Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Tomi Valkeinen Cc: Alex Deucher Cc: "Christian König" Cc: "David (ChunMing) Zhou" Cc: Thierry Reding Cc: Jonathan Hunter Cc: Dave Airlie Cc: Eric Anholt Cc: "Michel Dänzer" Cc: Chris Wilson Cc: Huang Rui Cc: Felix Kuehling Cc: Hawking Zhang Cc: Feifei Xu Cc: Jim Qu Cc: Evan Quan Cc: Matthew Auld Cc: Mika Kuoppala Cc: Thomas Zimmermann Cc: Kate Stewart Cc: Sumit Semwal Cc: Jilayne Lovejoy Cc: Thomas Gleixner Cc: Mikulas Patocka Cc: Greg Kroah-Hartman Cc: Junwei Zhang Cc: intel-gvt-dev@lists.freedesktop.org Cc: intel-gfx@lists.freedesktop.org Cc: amd-gfx@lists.freedesktop.org Cc: linux-tegra@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20190614203615.12639-10-daniel.vetter@ffwll.ch