linux-stable.git/drivers/gpu/drm/vmwgfx, branch linux-3.16.y

drm/vmwgfx: Fix setting of dma masks

2019-05-02T20:41:39+00:00

commit 4cbfa1e6c09e98450aab3240e5119b0ab2c9795b upstream.

Previously we set only the dma mask and not the coherent mask. Fix that.
Also, for clarity, make sure both are initially set to 64 bits.

Fixes: 0d00c488f3de: ("drm/vmwgfx: Fix the driver for large dma addresses")
Signed-off-by: Thomas Hellstrom 
Reviewed-by: Deepak Rawat 
Signed-off-by: Ben Hutchings

drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user

2019-05-02T20:41:39+00:00

commit 728354c005c36eaf44b6e5552372b67e60d17f56 upstream.

The function was unconditionally returning 0, and a caller would have to
rely on the returned fence pointer being NULL to detect errors. However,
the function vmw_execbuf_copy_fence_user() would expect a non-zero error
code in that case and would BUG otherwise.

So make sure we return a proper non-zero error code if the fence pointer
returned is NULL.

Fixes: ae2a104058e2: ("vmwgfx: Implement fence objects")
Signed-off-by: Thomas Hellstrom 
Reviewed-by: Deepak Rawat 
Signed-off-by: Ben Hutchings

drm/vmwgfx: Fix gcc-7.1.1 warning

2017-11-11T13:32:59+00:00

commit fcfffdd8f98ac305285dca568b5065ef86be6458 upstream.

The current code does not look correct, and the reason for it is
probably lost.  Since this now generates a compiler warning,
fix it to what makes sense.

Reported-by: Arnd Bergmann 
Reported-by: Linus Torvalds 
Signed-off-by: Sinclair Yeh 
Reviewed-by: Brian Paul 
Signed-off-by: Ben Hutchings

drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()

2017-09-15T17:30:05+00:00

commit f0c62e9878024300319ba2438adc7b06c6b9c448 upstream.

If vmalloc() fails then we need to a bit of cleanup before returning.

Fixes: fb1d9738ca05 ("drm/vmwgfx: Add DRM driver for VMware Virtual GPU")
Signed-off-by: Dan Carpenter 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Ben Hutchings

drm/vmwgfx: Make sure backup_handle is always valid

2017-07-18T17:40:40+00:00

commit 07678eca2cf9c9a18584e546c2b2a0d0c9a3150c upstream.

When vmw_gb_surface_define_ioctl() is called with an existing buffer,
we end up returning an uninitialized variable in the backup_handle.

The fix is to first initialize backup_handle to 0 just to be sure, and
second, when a user-provided buffer is found, we will use the
req->buffer_handle as the backup_handle.

Reported-by: Murray McAllister 
Signed-off-by: Sinclair Yeh 
Reviewed-by: Deepak Rawat 
[bwh: Backported to 3.16: There's no size check after vmw_user_dmabuf_lookup(),
 so only check ret == 0.]
Signed-off-by: Ben Hutchings

drm/vmwgfx: Remove getparam error message

2017-07-18T17:40:26+00:00

commit 53e16798b0864464c5444a204e1bb93ae246c429 upstream.

The mesa winsys sometimes uses unimplemented parameter requests to
check for features. Remove the error message to avoid bloating the
kernel log.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Brian Paul 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Ben Hutchings

drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces

2017-07-18T17:40:26+00:00

commit fe25deb7737ce6c0879ccf79c99fa1221d428bf2 upstream.

Previously, when a surface was opened using a legacy (non prime) handle,
it was verified to have been created by a client in the same master realm.
Relax this so that opening is also allowed recursively if the client
already has the surface open.

This works around a regression in svga mesa where opening of a shared
surface is used recursively to obtain surface information.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Sinclair Yeh 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()

2017-07-18T17:40:26+00:00

commit 63774069d9527a1aeaa4aa20e929ef5e8e9ecc38 upstream.

In vmw_get_cap_3d_ioctl(), a user can supply 0 for a size that is
used in vzalloc(). This eventually calls dump_stack() (in warn_alloc()),
which can leak useful addresses to dmesg.

Add check to avoid a size of 0.

Signed-off-by: Murray McAllister 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Ben Hutchings

drm/vmwgfx: Type-check lookups of fence objects

2017-07-18T17:40:26+00:00

commit f7652afa8eadb416b23eb57dec6f158529942041 upstream.

A malicious caller could otherwise hand over handles to other objects
causing all sorts of interesting problems.

Testing done: Ran a Fedora 25 desktop using both Xorg and
gnome-shell/Wayland.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Ben Hutchings

drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()

2017-07-02T16:13:03+00:00

commit ee9c4e681ec4f58e42a83cb0c22a0289ade1aacf upstream.

The 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is
a user-controlled 'uint32_t' value which is used as a loop count limit.
This can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1437431

Signed-off-by: Vladis Dronov 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Ben Hutchings