kernel/drivers/gpu/drm/vmwgfx, branch linux-4.1.y

drm/vmwgfx: Fix gcc-7.1.1 warning

2017-09-10T20:35:46Z

[ Upstream commit fcfffdd8f98ac305285dca568b5065ef86be6458 ] The current code does not look correct, and the reason for it is probably lost. Since this now generates a compiler warning, fix it to what makes sense. Cc: Reported-by: Arnd Bergmann Reported-by: Linus Torvalds Signed-off-by: Sinclair Yeh Reviewed-by: Brian Paul Signed-off-by: Sasha Levin

drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr

2017-07-31T17:37:49Z

[ Upstream commit 82fcee526ba8ca2c5d378bdf51b21b7eb058fe3a ] The hash table created during vmw_cmdbuf_res_man_create was never freed. This causes memory leak in context creation. Added the corresponding drm_ht_remove in vmw_cmdbuf_res_man_destroy. Tested for memory leak by running piglit overnight and kernel memory is not inflated which earlier was. Cc: Signed-off-by: Deepak Rawat Reviewed-by: Sinclair Yeh Signed-off-by: Thomas Hellstrom Signed-off-by: Sasha Levin

drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()

2017-06-26T02:02:19Z

[ Upstream commit f0c62e9878024300319ba2438adc7b06c6b9c448 ] If vmalloc() fails then we need to a bit of cleanup before returning. Cc: Fixes: fb1d9738ca05 ("drm/vmwgfx: Add DRM driver for VMware Virtual GPU") Signed-off-by: Dan Carpenter Reviewed-by: Sinclair Yeh Signed-off-by: Sasha Levin

drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()

2017-05-17T19:07:44Z

[ Upstream commit e7e11f99564222d82f0ce84bd521e57d78a6b678 ] In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the 'req->mip_levels' array. This array can be assigned any value from the user space. As both the 'num_sizes' and the array is uint32_t, it is easy to make 'num_sizes' overflow. The later 'mip_levels' is used as the loop count. This can lead an oob write. Add the check of 'req->mip_levels' to avoid this. Cc: Signed-off-by: Li Qiang Reviewed-by: Thomas Hellstrom Signed-off-by: Sasha Levin

drm/vmwgfx: Remove getparam error message

2017-05-17T19:07:44Z

[ Upstream commit 53e16798b0864464c5444a204e1bb93ae246c429 ] The mesa winsys sometimes uses unimplemented parameter requests to check for features. Remove the error message to avoid bloating the kernel log. Cc: Signed-off-by: Thomas Hellstrom Reviewed-by: Brian Paul Reviewed-by: Sinclair Yeh Signed-off-by: Sasha Levin

drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()

2017-05-17T19:07:44Z

[ Upstream commit 63774069d9527a1aeaa4aa20e929ef5e8e9ecc38 ] In vmw_get_cap_3d_ioctl(), a user can supply 0 for a size that is used in vzalloc(). This eventually calls dump_stack() (in warn_alloc()), which can leak useful addresses to dmesg. Add check to avoid a size of 0. Cc: Signed-off-by: Murray McAllister Reviewed-by: Sinclair Yeh Signed-off-by: Sasha Levin

drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()

2017-05-17T19:07:44Z

[ Upstream commit 36274ab8c596f1240c606bb514da329add2a1bcd ] Before memory allocations vmw_surface_define_ioctl() checks the upper-bounds of a user-supplied size, but does not check if the supplied size is 0. Add check to avoid NULL pointer dereferences. Cc: Signed-off-by: Murray McAllister Reviewed-by: Sinclair Yeh Signed-off-by: Sasha Levin

drm/vmwgfx: Type-check lookups of fence objects

2017-05-17T19:07:44Z

[ Upstream commit f7652afa8eadb416b23eb57dec6f158529942041 ] A malicious caller could otherwise hand over handles to other objects causing all sorts of interesting problems. Testing done: Ran a Fedora 25 desktop using both Xorg and gnome-shell/Wayland. Cc: Signed-off-by: Thomas Hellstrom Reviewed-by: Sinclair Yeh Signed-off-by: Sasha Levin

drm/vmwgfx: respect 'nomodeset'

2016-02-15T20:45:26Z

[ Upstream commit 96c5d076f0a5e2023ecdb44d8261f87641ee71e0 ] Signed-off-by: Rob Clark Reviewed-by: Thomas Hellstrom . Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie Signed-off-by: Sasha Levin

drm/vmwgfx: Fix up user_dmabuf refcounting

2015-11-09T22:33:39Z

commit 54c12bc374408faddbff75dbf1a6167c19af39c4 upstream. If user space calls unreference on a user_dmabuf it will typically kill the struct ttm_base_object member which is responsible for the user-space visibility. However the dmabuf part may still be alive and refcounted. In some situations, like for shared guest-backed surface referencing/opening, the driver may try to reference the struct ttm_base_object member again, causing an immediate kernel warning and a later kernel NULL pointer dereference. Fix this by always maintaining a reference on the struct ttm_base_object member, in situations where it might subsequently be referenced. Signed-off-by: Thomas Hellstrom Reviewed-by: Brian Paul Reviewed-by: Sinclair Yeh Signed-off-by: Greg Kroah-Hartman