linux-stable.git/drivers/gpu/drm/vgem, branch linux-5.4.y

drm/vgem: add missing mutex_destroy

2023-05-17T09:35:35+00:00

[ Upstream commit 7c18189b14b33c1fbf76480b1bd217877c086e67 ]

vgem_fence_open() instantiates a mutex for a particular fence
instance, but never destroys it by calling mutex_destroy() in
vgem_fence_close().

So, add the missing mutex_destroy() to guarantee proper resource
destruction.

Fixes: 407779848445 ("drm/vgem: Attach sw fences to exported vGEM dma-buf (ioctl)")
Signed-off-by: Maíra Canal 
Reviewed-by: Stanislaw Gruszka 
Signed-off-by: Maíra Canal 
Link: https://patchwork.freedesktop.org/patch/msgid/20230202125517.427976-1-mcanal@igalia.com
Signed-off-by: Sasha Levin

drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset()

2020-08-26T08:40:47+00:00

[ Upstream commit 119c53d2d4044c59c450c4f5a568d80b9d861856 ]

drm_gem_dumb_map_offset() now exists and does everything
vgem_gem_dump_map does and *ought* to do.

In particular, vgem_gem_dumb_map() was trying to reject mmapping an
imported dmabuf by checking the existence of obj->filp. Unfortunately,
we always allocated an obj->filp, even if unused for an imported dmabuf.
Instead, the drm_gem_dumb_map_offset(), since commit 90378e589192
("drm/gem: drm_gem_dumb_map_offset(): reject dma-buf"), uses the
obj->import_attach to reject such invalid mmaps.

This prevents vgem from allowing userspace mmapping the dumb handle and
attempting to incorrectly fault in remote pages belonging to another
device, where there may not even be a struct page.

v2: Use the default drm_gem_dumb_map_offset() callback

Fixes: af33a9190d02 ("drm/vgem: Enable dmabuf import interfaces")
Signed-off-by: Chris Wilson 
Reviewed-by: Daniel Vetter 
Cc:  # v4.13+
Link: https://patchwork.freedesktop.org/patch/msgid/20200708154911.21236-1-chris@chris-wilson.co.uk
Signed-off-by: Sasha Levin

drm/vgem: Close use-after-free race in vgem_gem_create

2020-02-19T18:53:04+00:00

commit 4b848f20eda5974020f043ca14bacf7a7e634fc8 upstream.

There's two references floating around here (for the object reference,
not the handle_count reference, that's a different thing):

- The temporary reference held by vgem_gem_create, acquired by
  creating the object and released by calling
  drm_gem_object_put_unlocked.

- The reference held by the object handle, created by
  drm_gem_handle_create. This one generally outlives the function,
  except if a 2nd thread races with a GEM_CLOSE ioctl call.

So usually everything is correct, except in that race case, where the
access to gem_object->size could be looking at freed data already.
Which again isn't a real problem (userspace shot its feet off already
with the race, we could return garbage), but maybe someone can exploit
this as an information leak.

Cc: Dan Carpenter 
Cc: Hillf Danton 
Reported-by: syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Cc: Emil Velikov 
Cc: Daniel Vetter 
Cc: Sean Paul 
Cc: Chris Wilson 
Cc: Eric Anholt 
Cc: Sam Ravnborg 
Cc: Rob Clark 
Reviewed-by: Chris Wilson 
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20200202132133.1891846-1-daniel.vetter@ffwll.ch
Signed-off-by: Greg Kroah-Hartman

dma-buf: rename reservation_object to dma_resv

2019-08-13T07:09:30+00:00

Be more consistent with the naming of the other DMA-buf objects.

Signed-off-by: Christian König 
Reviewed-by: Chris Wilson 
Link: https://patchwork.freedesktop.org/patch/323401/

drm/vgem: drop DRM_AUTH usage from the driver

2019-08-07T15:53:21+00:00

The authentication can be circumvented, by design, by using the render
node.

From the driver POV there is no distinction between primary and render
nodes, thus we can drop the token.

Cc: David Airlie 
Cc: Daniel Vetter 
Signed-off-by: Emil Velikov 
Signed-off-by: Sean Paul 
Link: https://patchwork.freedesktop.org/patch/msgid/20190527081741.14235-11-emil.l.velikov@gmail.com

Revert "drm/vgem: drop DRM_AUTH usage from the driver"

2019-08-07T14:45:00+00:00

This reverts commit e4eee93d25776da998ec2dfaabe7d2206598d26d.

Mandatory review was missing from this patch.

Acked-by: Maxime Ripard 
Acked-by: Emil Velikov 
Signed-off-by: Sean Paul 
Link: https://patchwork.freedesktop.org/patch/msgid/20190807142101.251400-4-sean@poorly.run

drm/vgem: drop use of drmP.h

2019-07-17T10:52:55+00:00

Drop use of the deprecated header drmP.h.
Replace with necessary includes in the individual .c files.

Signed-off-by: Sam Ravnborg 
Acked-by: Emil Velikov 
Cc: David Airlie 
Cc: Daniel Vetter 
Cc: Deepak Sharma 
Cc: Thomas Zimmermann 
Link: https://patchwork.freedesktop.org/patch/msgid/20190716064220.18157-13-sam@ravnborg.org

drm/vgem: Reclassify buffer creation debug message

2019-07-12T16:35:37+00:00

A buffer is created in response to the user ioctl, it should therefore
be a plain DRM_DEBUG() message to reflect it being a user invoked
response and not a driver construct.

This is just to make the commonplace drm.debug=[26e] quieter when
running with vgem.

Signed-off-by: Chris Wilson 
Cc: Daniel Vetter 
Reviewed-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20190712120147.29830-1-chris@chris-wilson.co.uk

drm/vgem: drop DRM_AUTH usage from the driver

2019-06-26T14:00:40+00:00

The authentication can be circumvented, by design, by using the render
node.

From the driver POV there is no distinction between primary and render
nodes, thus we can drop the token.

Cc: David Airlie 
Cc: Daniel Vetter 
Signed-off-by: Emil Velikov 
Link: https://patchwork.freedesktop.org/patch/msgid/20190527081741.14235-11-emil.l.velikov@gmail.com

drm/vgem: Ditch attach trickery in the fence ioctl

2019-06-21T20:20:20+00:00

It looks like this was done purely to get a consistent place to look
up the reservation object pointer. With the drm_prime.c helper code
now also setting gem_object->resv for imported objects we can just use
that pointer directly, instead of first ensuring a dma-buf exists.

v2: Note that I screwed up the patch ordering, hence why this needed
a Fixes: tag - CI spotted the broken intermediate state.

Fixes: 5eab998741c8 ("drm/vgem: Drop drm_gem_prime_export")
Reviewed-by: Emil Velikov 
Reviewed-by: Chris Wilson 
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20190614203615.12639-49-daniel.vetter@ffwll.ch