linux-stable.git/drivers/gpu, branch v3.2.91

drm/vmwgfx: Remove getparam error message

2017-07-18T17:38:39+00:00

commit 53e16798b0864464c5444a204e1bb93ae246c429 upstream.

The mesa winsys sometimes uses unimplemented parameter requests to
check for features. Remove the error message to avoid bloating the
kernel log.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Brian Paul 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Ben Hutchings

drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()

2017-07-18T17:38:39+00:00

commit 63774069d9527a1aeaa4aa20e929ef5e8e9ecc38 upstream.

In vmw_get_cap_3d_ioctl(), a user can supply 0 for a size that is
used in vzalloc(). This eventually calls dump_stack() (in warn_alloc()),
which can leak useful addresses to dmesg.

Add check to avoid a size of 0.

Signed-off-by: Murray McAllister 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Ben Hutchings

drm/vmwgfx: Type-check lookups of fence objects

2017-07-18T17:38:38+00:00

commit f7652afa8eadb416b23eb57dec6f158529942041 upstream.

A malicious caller could otherwise hand over handles to other objects
causing all sorts of interesting problems.

Testing done: Ran a Fedora 25 desktop using both Xorg and
gnome-shell/Wayland.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Sinclair Yeh 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()

2017-06-05T20:13:53+00:00

commit e7e11f99564222d82f0ce84bd521e57d78a6b678 upstream.

In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the
'req->mip_levels' array. This array can be assigned any value from
the user space. As both the 'num_sizes' and the array is uint32_t,
it is easy to make 'num_sizes' overflow. The later 'mip_levels' is
used as the loop count. This can lead an oob write. Add the check of
'req->mip_levels' to avoid this.

Signed-off-by: Li Qiang 
Reviewed-by: Thomas Hellstrom 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()

2017-06-05T20:13:53+00:00

commit 36274ab8c596f1240c606bb514da329add2a1bcd upstream.

Before memory allocations vmw_surface_define_ioctl() checks the
upper-bounds of a user-supplied size, but does not check if the
supplied size is 0.

Add check to avoid NULL pointer dereferences.

Signed-off-by: Murray McAllister 
Reviewed-by: Sinclair Yeh 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

drm/radeon: handle vfct with multiple vbios images

2017-06-05T20:13:45+00:00

commit a882f5de402ded769af74fbf276132f9c175049c upstream.

The vfct table can contain multiple vbios images if the
platform contains multiple GPUs. Noticed by netkas on
phoronix forums.  This patch fixes those platforms.

Signed-off-by: Alex Deucher 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

drm/ttm: Make sure BOs being swapped out are cacheable

2017-06-05T20:13:44+00:00

commit 239ac65fa5ffab71adf66e642750f940e7241d99 upstream.

The current caching state may not be tt_cached, even though the
placement contains TTM_PL_FLAG_CACHED, because placement can contain
multiple caching flags. Trying to swap out such a BO would trip up the

	BUG_ON(ttm->caching_state != tt_cached);

in ttm_tt_swapout.

Signed-off-by: Michel Dänzer 
Reviewed-by: Thomas Hellstrom 
Reviewed-by: Christian König .
Reviewed-by: Sinclair Yeh 
Signed-off-by: Christian König 
Signed-off-by: Ben Hutchings

drm: Reject page_flip for !DRIVER_MODESET

2016-11-20T01:01:34+00:00

commit 6f00975c619064a18c23fd3aced325ae165a73b9 upstream.

Somehow this one slipped through, which means drivers without modeset
support can be oopsed (since those also don't call
drm_mode_config_init, which means the crtc lookup will chase an
uninitalized idr).

Reported-by: Alexander Potapenko 
Cc: Alexander Potapenko 
Signed-off-by: Daniel Vetter 
Reviewed-by: Chris Wilson 
Signed-off-by: Dave Airlie 
Signed-off-by: Ben Hutchings

drm/radeon: fix radeon_move_blit on 32bit systems

2016-11-20T01:01:33+00:00

commit 13f479b9df4e2bbf2d16e7e1b02f3f55f70e2455 upstream.

This bug seems to be present for a very long time.

Signed-off-by: Christian König 
Reviewed-by: Alex Deucher 
Signed-off-by: Alex Deucher 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

drm/edid: Add 6 bpc quirk for display AEO model 0.

2016-11-20T01:01:31+00:00

commit e10aec652f31ec61d6a0b4d00d8ef8d2b66fa0fd upstream.

Bugzilla https://bugzilla.kernel.org/show_bug.cgi?id=105331
reports that the "AEO model 0" display is driven with 8 bpc
without dithering by default, which looks bad because that
panel is apparently a 6 bpc DP panel with faulty EDID.

A fix for this was made by commit 013dd9e03872
("drm/i915/dp: fall back to 18 bpp when sink capability is unknown").

That commit triggers new regressions in precision for DP->DVI and
DP->VGA displays. A patch is out to revert that commit, but it will
revert video output for the AEO model 0 panel to 8 bpc without
dithering.

The EDID 1.3 of that panel, as decoded from the xrandr output
attached to that bugzilla bug report, is somewhat faulty, and beyond
other problems also sets the "DFP 1.x compliant TMDS" bit, which
according to DFP spec means to drive the panel with 8 bpc and
no dithering in absence of other colorimetry information.

Try to make the original bug reporter happy despite the
faulty EDID by adding a quirk to mark that panel as 6 bpc,
so 6 bpc output with dithering creates a nice picture.

Tested by injecting the edid from the fdo bug into a DP connector
via drm_kms_helper.edid_firmware and verifying the 6 bpc + dithering
is selected.

This patch should be backported to stable.

Signed-off-by: Mario Kleiner 
Cc: Jani Nikula 
Cc: Ville Syrjälä 
Cc: Daniel Vetter 
Signed-off-by: Dave Airlie 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings