kernel/drivers/gpu/drm/drm_gem.c, branch linux-4.1.y

drm: Release driver tracking before making the object available again

2017-10-04T01:36:33Z

[ Upstream commit fe4600a548f2763dec91b3b27a1245c370ceee2a ] This is the same bug as we fixed in commit f6cd7daecff5 ("drm: Release driver references to handle before making it available again"), but now the exposure is via the PRIME lookup tables. If we remove the object/handle from the PRIME lut, then a new request for the same object/fd will generate a new handle, thus for a short window that object is known to userspace by two different handles. Fix this by releasing the driver tracking before PRIME. Fixes: 0ff926c7d4f0 ("drm/prime: add exported buffers to current fprivs imported buffer list (v2)") Signed-off-by: Chris Wilson Cc: David Airlie Cc: Daniel Vetter Cc: Rob Clark Cc: Ville Syrjälä Cc: Thierry Reding Cc: stable@vger.kernel.org Reviewed-by: Daniel Vetter Signed-off-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20170819120558.6465-1-chris@chris-wilson.co.uk Signed-off-by: Sasha Levin

Merge tag 'drm/gem-cma/for-3.19-rc1' of git://people.freedesktop.org/~tagr/linux into drm-next

2014-11-14T23:50:21Z

drm: Sanitize DRM_IOCTL_MODE_CREATE_DUMB input Some drivers erroneously treat the .pitch and .size fields of struct drm_mode_create_dumb as inputs. While the include/uapi/drm/drm_mode.h header has a comment denoting them as outputs, that seemingly wasn't enough to make drivers use them properly. The result is that some userspace doesn't explicitly zero out those fields, assuming that the kernel won't use them. That causes problems since the data within the structure might be uninitialized, so bogus data may end up confusing drivers (ridiculously large values for the pitch, ...). This series attempts to improve the situation by fixing all drivers to not use the output fields. Furthermore to spare new drivers this bad surprise, the DRM core now zeros out these fields prior to handing the data structure to the driver. Lessons learned from this are that future IOCTLs should be properly documented (in the DRM DocBook for example) and should be rigorously defined. To prevent misuse like this, userspace should be required to zero out all output fields. The kernel should check for this and fail if that's not the case. * tag 'drm/gem-cma/for-3.19-rc1' of git://people.freedesktop.org/~tagr/linux: drm/cma: Remove call to drm_gem_free_mmap_offset() drm: Sanitize DRM_IOCTL_MODE_CREATE_DUMB input drm/rcar: gem: dumb: pitch is an output drm/omap: gem: dumb: pitch is an output drm/cma: Introduce drm_gem_cma_dumb_create_internal() drm/doc: Add GEM/CMA helpers to kerneldoc drm/doc: mm: Fix indentation drm/gem: Fix a few kerneldoc typos

drm/gem: Fix a few kerneldoc typos

2014-11-13T12:27:08Z

While at it, adjust the drm_gem_handle_create() function declaration to be more consistent with other functions in the file. Reviewed-by: Daniel Vetter Signed-off-by: Thierry Reding

drm/gem: Fix typo in kerneldoc

2014-11-13T09:43:49Z

The function being documented is drm_gem_object_handle_free(), not drm_gem_object_free(). Signed-off-by: Thierry Reding

drm/core: use helper to check driver features

2014-10-03T08:38:56Z

The patch replaces direct access to driver_features field by calls to helper function. Signed-off-by: Andrzej Hajda Reviewed-by: David Herrmann Signed-off-by: Daniel Vetter

drm: Extract

2014-09-24T01:43:41Z

v2: Don't forget git add, noticed by David. Cc: David Herrmann Signed-off-by: Daniel Vetter Acked-by: David Herrmann Acked-by: Alex Deucher Signed-off-by: Dave Airlie

drm/gem: Don't call drm_mmap from drm_gem_mmap

2014-09-24T01:42:58Z

The only user I could dig out was i915 back when ums+gem was still a thing. But we've just very much killed that, and even when someone screams about that we should resurrect that with a special hack (wrapping drm_gem_mmap) in i915, not in the core code. So good riddance to another entry point of the legacy buffer mapping code. Signed-off-by: Daniel Vetter Reviewed-by: David Herrmann Acked-by: Alex Deucher Signed-off-by: Dave Airlie

Merge tag 'topic/core-stuff-2014-09-15' of git://anongit.freedesktop.org/drm-intel into drm-next

2014-09-15T09:55:55Z

Here's the updated topic/core-stuff pull request with the two patches already merged into drm-fixes dropped. * tag 'topic/core-stuff-2014-09-15' of git://anongit.freedesktop.org/drm-intel: drm: Drop modeset locking from crtc init function drm/i915/hdmi: Enable pipe pixel replication for SD interlaced modes drm/edid: Reduce horizontal timings for pixel replicated modes drm: Include task->name and master status in debugfs clients info drm/gem: Fix kerneldoc typo drm: use c99 initializers in structures drm: fix drm_modeset_lock.h kernel-doc notation

drm/gem: Fix kerneldoc typo

2014-09-15T06:56:28Z

The drm_gem_private_object_init function is called drm_gem_object_init in its kerneldoc. Fix it. Signed-off-by: Laurent Pinchart Signed-off-by: Daniel Vetter

drm: Move piles of functions from drmP.h to drm_internal.h

2014-09-12T09:16:29Z

This way drivers can't grow crazy ideas any more, and it also helps a bit in reviewing EXPORT_SYMBOLS. v2: Even more stuff. Unfortunately we can't move drm_vm_open_locked because exynos does some horrible stuff with it. Signed-off-by: Daniel Vetter