linux-stable.git/drivers/gpu/drm/msm, branch v4.9.142

drm/msm: Fix possible null dereference on failure of get_pages()

2018-11-10T15:42:53+00:00

[ Upstream commit 3976626ea3d2011f8fd3f3a47070a8b792018253 ]

Commit 62e3a3e342af changed get_pages() to initialise
msm_gem_object::pages before trying to initialise msm_gem_object::sgt,
so that put_pages() would properly clean up pages in the failure
case.

However, this means that put_pages() now needs to check that
msm_gem_object::sgt is not null before trying to clean it up, and
this check was only applied to part of the cleanup code.  Move
it all into the conditional block.  (Strictly speaking we don't
need to make the kfree() conditional, but since we can't avoid
checking for null ourselves we may as well do so.)

Fixes: 62e3a3e342af ("drm/msm: fix leak in failed get_pages")
Signed-off-by: Ben Hutchings 
Reviewed-by: Jordan Crouse 
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin

drm/msm: Take the mutex before calling msm_gem_new_impl

2018-04-13T17:48:07+00:00

[ Upstream commit 90dd57de4a043f642179b1323a31ca3ced826611 ]

Amongst its other duties, msm_gem_new_impl adds the newly created
GEM object to the shared inactive list which may also be actively
modifiying the list during submission.  All the paths to modify
the list are protected by the mutex except for the one through
msm_gem_import which can end up causing list corruption.

Signed-off-by: Jordan Crouse 
[add extra WARN_ON(!mutex_is_locked(&dev->struct_mutex))]
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

drm/msm: fix leak in failed get_pages

2018-03-24T10:00:23+00:00

[ Upstream commit 62e3a3e342af3c313ab38603811ecdb1fcc79edb ]

get_pages doesn't keep a reference of the pages allocated
when it fails later in the code path. This can lead to
a memory leak. Keep reference of the allocated pages so
that it can be freed when msm_gem_free_object gets called
later during cleanup.

Signed-off-by: Prakash Kamliya 
Signed-off-by: Sharat Masetty 
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

drm/msm: fix an integer overflow test

2017-11-08T09:08:32+00:00

commit 65e93108891e571f177c202add9288eda9ac4100 upstream.

We recently added an integer overflow check but it needs an additional
tweak to work properly on 32 bit systems.

The problem is that we're doing the right hand side of the assignment as
type unsigned long so the max it will have an integer overflow instead
of being larger than SIZE_MAX.  That means the "sz > SIZE_MAX" condition
is never true even on 32 bit systems.  We need to first cast it to u64
and then do the math.

Fixes: 4a630fadbb29 ("drm/msm: Fix potential buffer overflow issue")
Signed-off-by: Dan Carpenter 
Acked-by: Jordan Crouse 
Signed-off-by: Rob Clark 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

drm/msm: Fix potential buffer overflow issue

2017-11-08T09:08:32+00:00

commit 4a630fadbb29d9efaedb525f1a8f7449ad107641 upstream.

In function submit_create, if nr_cmds or nr_bos is assigned with
negative value, the allocated buffer may be small than intended.
Using this buffer will lead to buffer overflow issue.

Signed-off-by: Kasin Li 
Signed-off-by: Jordan Crouse 
Signed-off-by: Rob Clark 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set

2017-08-07T01:59:45+00:00

[ Upstream commit a6cb3b864b21b7345f824a4faa12b723c8aaf099 ]

For every submission buffer object one of MSM_SUBMIT_BO_WRITE
and MSM_SUBMIT_BO_READ must be set (and nothing else). If we
allowed zero then the buffer object would never get queued to
be unreferenced.

Signed-off-by: Jordan Crouse 
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

drm/msm: Put back the vaddr in submit_reloc()

2017-08-07T01:59:45+00:00

[ Upstream commit 6490abc4bc35fa4f3bdb9c7e49096943c50e29ea ]

The error cases in submit_reloc() need to put back the virtual
address of the bo before failling. Add a single failure path
for the function.

Signed-off-by: Jordan Crouse 
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

drm/msm: Ensure that the hardware write pointer is valid

2017-08-07T01:59:45+00:00

[ Upstream commit 88b333b0ed790f9433ff542b163bf972953b74d3 ]

Currently the value written to CP_RB_WPTR is calculated on the fly as
(rb->next - rb->start). But as the code is designed rb->next is wrapped
before writing the commands so if a series of commands happened to
fit perfectly in the ringbuffer, rb->next would end up being equal to
rb->size / 4 and thus result in an out of bounds address to CP_RB_WPTR.

The easiest way to fix this is to mask WPTR when writing it to the
hardware; it makes the hardware happy and the rest of the ringbuffer
math appears to work and there isn't any point in upsetting anything.

Signed-off-by: Jordan Crouse 
[squash in is_power_of_2() check]
Signed-off-by: Rob Clark 

Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

drm/msm: Expose our reservation object when exporting a dmabuf.

2017-06-14T13:06:00+00:00

commit 43523eba79bda8f5b4c27f8ffe20ea078d20113a upstream.

Without this, polling on the dma-buf (and presumably other devices
synchronizing against our rendering) would return immediately, even
while the BO was busy.

Signed-off-by: Eric Anholt 
Reviewed-by: Daniel Vetter 
Cc: Rob Clark 
Cc: linux-arm-msm@vger.kernel.org
Cc: freedreno@lists.freedesktop.org
Reviewed-by: Rob Clark 
Signed-off-by: Rob Clark 
Signed-off-by: Greg Kroah-Hartman

drm/msm/adreno: move function declarations to header file

2017-04-12T10:41:21+00:00

[ Upstream commit a5725ab0497ad91a2df7c01a78bf1a0cc5be4526 ]

We get 2 warnings when building kernel with W=1:
drivers/gpu/drm/msm/adreno/a3xx_gpu.c:535:17: warning: no previous prototype for 'a3xx_gpu_init' [-Wmissing-prototypes]
drivers/gpu/drm/msm/adreno/a4xx_gpu.c:624:17: warning: no previous prototype for 'a4xx_gpu_init' [-Wmissing-prototypes]

In fact, both functions are declared in
drivers/gpu/drm/msm/adreno/adreno_device.c, but should be declared
in a header file. So this patch moves both function declarations to
drivers/gpu/drm/msm/adreno/adreno_gpu.h.

Signed-off-by: Baoyou Xie 
Reviewed-by: Arnd Bergmann 
Signed-off-by: Daniel Vetter 
Link: http://patchwork.freedesktop.org/patch/msgid/1477127865-9381-1-git-send-email-baoyou.xie@linaro.org
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman