linux-stable.git/drivers/dma-buf, branch linux-5.17.y

dma-buf: ensure unique directory name for dmabuf stats

2022-05-25T07:59:04+00:00

commit 370704e707a5f2d3c9a1d4ed8bd8cd67507d7bb5 upstream.

The dmabuf file uses get_next_ino()(through dma_buf_getfile() ->
alloc_anon_inode()) to get an inode number and uses the same as a
directory name under /sys/kernel/dmabuf/buffers/. This directory is
used to collect the dmabuf stats and it is created through
dma_buf_stats_setup(). At current, failure to create this directory
entry can make the dma_buf_export() to fail.

Now, as the get_next_ino() can definitely give a repetitive inode no
causing the directory entry creation to fail with -EEXIST. This is a
problem on the systems where dmabuf stats functionality is enabled on
the production builds can make the dma_buf_export(), though the dmabuf
memory is allocated successfully, to fail just because it couldn't
create stats entry.

This issue we are able to see on the snapdragon system within 13 days
where there already exists a directory with inode no "122602" so
dma_buf_stats_setup() failed with -EEXIST as it is trying to create
the same directory entry.

To make the dentry name as unique, use the dmabuf fs specific inode
which is based on the simple atomic variable increment. There is tmpfs
subsystem too which relies on its own inode generation rather than
relying on the get_next_ino() for the same reason of avoiding the
duplicate inodes[1].

[1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/patch/?id=e809d5f0b5c912fe981dce738f3283b2010665f0

Signed-off-by: Charan Teja Kalla 
Cc:  # 5.15.x+
Reviewed-by: Greg Kroah-Hartman 
Reviewed-by: Christian König 
Link: https://patchwork.freedesktop.org/patch/msgid/1652441296-1986-1-git-send-email-quic_charante@quicinc.com
Signed-off-by: Christian König 
Signed-off-by: Greg Kroah-Hartman

dma-buf: call dma_buf_stats_setup after dmabuf is in valid list

2022-05-18T08:28:23+00:00

commit ef3a6b70507a2add2cd2e01f5eb9b54d561bacb9 upstream.

When dma_buf_stats_setup() fails, it closes the dmabuf file which
results into the calling of dma_buf_file_release() where it does
list_del(&dmabuf->list_node) with out first adding it to the proper
list. This is resulting into panic in the below path:
__list_del_entry_valid+0x38/0xac
dma_buf_file_release+0x74/0x158
__fput+0xf4/0x428
____fput+0x14/0x24
task_work_run+0x178/0x24c
do_notify_resume+0x194/0x264
work_pending+0xc/0x5f0

Fix it by moving the dma_buf_stats_setup() after dmabuf is added to the
list.

Fixes: bdb8d06dfefd ("dmabuf: Add the capability to expose DMA-BUF stats in sysfs")
Signed-off-by: Charan Teja Reddy 
Tested-by: T.J. Mercier 
Acked-by: T.J. Mercier 
Cc:  # 5.15.x+
Reviewed-by: Christian König 
Signed-off-by: Christian König 
Link: https://patchwork.freedesktop.org/patch/msgid/1652125797-2043-1-git-send-email-quic_charante@quicinc.com
Signed-off-by: Greg Kroah-Hartman

udmabuf: validate ubuf->pagecount

2022-04-08T11:57:56+00:00

[ Upstream commit 2b6dd600dd72573c23ea180b5b0b2f1813405882 ]

Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
problem was in ubuf->pages == ZERO_PTR.

ubuf->pagecount is calculated from arguments passed from user-space. If
user creates udmabuf with list.size == 0 then ubuf->pagecount will be
also equal to zero; it causes kmalloc_array() to return ZERO_PTR.

Fix it by validating ubuf->pagecount before passing it to
kmalloc_array().

Fixes: fbb0de795078 ("Add udmabuf misc device")
Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin 
Link: http://patchwork.freedesktop.org/patch/msgid/20211230142649.23022-1-paskripkin@gmail.com
Signed-off-by: Gerd Hoffmann 
Signed-off-by: Sasha Levin

dma-buf: heaps: Fix potential spectre v1 gadget

2022-02-01T07:48:09+00:00

It appears like nr could be a Spectre v1 gadget as it's supplied by a
user and used as an array index. Prevent the contents
of kernel memory from being leaked to userspace via speculative
execution by using array_index_nospec.

Signed-off-by: Jordy Zomer 
Fixes: c02a81fba74f ("dma-buf: Add dma-buf heaps framework")
Cc:  # v5.6+
Acked-by: John Stultz 
Signed-off-by: Sumit Semwal 
 [sumits: added fixes and cc: stable tags]
Link: https://patchwork.freedesktop.org/patch/msgid/20220129150604.3461652-1-jordy@pwning.systems

Merge tag 'drm-next-2022-01-14' of git://anongit.freedesktop.org/drm/drm

2022-01-16T04:52:38+00:00

Pull drm fixes from Daniel Vetter:
"drivers fixes:

   - i915 fixes for ttm backend + one pm wakelock fix

   - amdgpu fixes, fairly big pile of small things all over. Note this
     doesn't yet containe the fixed version of the otg sync patch that
     blew up

   - small driver fixes: meson, sun4i, vga16fb probe fix

  drm core fixes:

   - cma-buf heap locking

   - ttm compilation

   - self refresh helper state check

   - wrong error message in atomic helpers

   - mipi-dbi buffer mapping"

* tag 'drm-next-2022-01-14' of git://anongit.freedesktop.org/drm/drm: (49 commits)
  drm/mipi-dbi: Fix source-buffer address in mipi_dbi_buf_copy
  drm: fix error found in some cases after the patch d1af5cd86997
  drm/ttm: fix compilation on ARCH=um
  dma-buf: cma_heap: Fix mutex locking section
  video: vga16fb: Only probe for EGA and VGA 16 color graphic cards
  drm/amdkfd: Fix ASIC name typos
  drm/amdkfd: Fix DQM asserts on Hawaii
  drm/amdgpu: Use correct VIEWPORT_DIMENSION for DCN2
  drm/amd/pm: only send GmiPwrDnControl msg on master die (v3)
  drm/amdgpu: use spin_lock_irqsave to avoid deadlock by local interrupt
  drm/amdgpu: not return error on the init_apu_flags
  drm/amdkfd: Use prange->update_list head for remove_list
  drm/amdkfd: Use prange->list head for insert_list
  drm/amdkfd: make SPDX License expression more sound
  drm/amdkfd: Check for null pointer after calling kmemdup
  drm/amd/display: invalid parameter check in dmub_hpd_callback
  Revert "drm/amdgpu: Don't inherit GEM object VMAs in child process"
  drm/amd/display: reset dcn31 SMU mailbox on failures
  drm/amdkfd: use default_groups in kobj_type
  drm/amdgpu: use default_groups in kobj_type
  ...

Merge tag 'drm-misc-fixes-2022-01-14' of git://anongit.freedesktop.org/drm/drm-misc into drm-next

2022-01-14T14:17:17+00:00

Two DT bindings fixes for meson, a device refcounting fix for sun4i, a
probe fix for vga16fb, a locking fix for the CMA dma-buf heap and a
compilation fix for ttm.

Signed-off-by: Daniel Vetter 
[danvet: I made sure I have exactly the same conflict resolution as
Linus in 8d0749b4f83b ("Merge tag 'drm-next-2022-01-07' of
git://anongit.freedesktop.org/drm/drm") to avoid further conflict fun.
From: Maxime Ripard 
Link: https://patchwork.freedesktop.org/patch/msgid/20220114125454.zs46ny52lrxk3ljz@houat

dma-buf: cma_heap: Fix mutex locking section

2022-01-13T11:05:21+00:00

Fix cma_heap_buffer mutex locking critical section to protect vmap_cnt
and vaddr.

Fixes: a5d2d29e24be ("dma-buf: heaps: Move heap-helper logic into the cma_heap implementation")
Signed-off-by: Weizhao Ouyang 
Acked-by: John Stultz 
Signed-off-by: Sumit Semwal 
Link: https://patchwork.freedesktop.org/patch/msgid/20220104073545.124244-1-o451686892@gmail.com

Merge tag 'driver-core-5.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

2022-01-12T19:11:34+00:00

Pull driver core updates from Greg KH:
 "Here is the set of changes for the driver core for 5.17-rc1.

  Lots of little things here, including:

   - kobj_type cleanups

   - auxiliary_bus documentation updates

   - auxiliary_device conversions for some drivers (relevant subsystems
     all have provided acks for these)

   - kernfs lock contention reduction for some workloads

   - other tiny cleanups and changes.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'driver-core-5.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (43 commits)
  kobject documentation: remove default_attrs information
  drivers/firmware: Add missing platform_device_put() in sysfb_create_simplefb
  debugfs: lockdown: Allow reading debugfs files that are not world readable
  driver core: Make bus notifiers in right order in really_probe()
  driver core: Move driver_sysfs_remove() after driver_sysfs_add()
  firmware: edd: remove empty default_attrs array
  firmware: dmi-sysfs: use default_groups in kobj_type
  qemu_fw_cfg: use default_groups in kobj_type
  firmware: memmap: use default_groups in kobj_type
  sh: sq: use default_groups in kobj_type
  headers/uninline: Uninline single-use function: kobject_has_children()
  devtmpfs: mount with noexec and nosuid
  driver core: Simplify async probe test code by using ktime_ms_delta()
  nilfs2: use default_groups in kobj_type
  kobject: remove kset from struct kset_uevent_ops callbacks
  driver core: make kobj_type constant.
  driver core: platform: document registration-failure requirement
  vdpa/mlx5: Use auxiliary_device driver data helpers
  net/mlx5e: Use auxiliary_device driver data helpers
  soundwire: intel: Use auxiliary_device driver data helpers
  ...

kobject: remove kset from struct kset_uevent_ops callbacks

2021-12-28T10:26:18+00:00

There is no need to pass the pointer to the kset in the struct
kset_uevent_ops callbacks as no one uses it, so just remove that pointer
entirely.

Reviewed-by: Rafael J. Wysocki 
Reviewed-by: Wedson Almeida Filho 
Link: https://lore.kernel.org/r/20211227163924.3970661-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

Merge v5.16-rc5 into drm-next

2021-12-14T09:24:28+00:00

Thomas Zimmermann requested a fixes backmerge, specifically also for
96c5f82ef0a1 ("drm/vc4: fix error code in vc4_create_object()")

Just a bunch of adjacent changes conflicts, even the big pile of them
in vc4.

Signed-off-by: Daniel Vetter