iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/gpu/drm/msm
History
Rob Clark d78d383ab3 drm/msm: protect against faults from copy_from_user() in submit ioctl 
An evil userspace could try to cause deadlock by passing an unfaulted-in
GEM bo as submit->bos (or submit->cmds) table.  Which will trigger
msm_gem_fault() while we already hold struct_mutex.  See:

https://github.com/freedreno/msmtest/blob/master/evilsubmittest.c

Cc: stable@vger.kernel.org
Signed-off-by: Rob Clark <robdclark@gmail.com>
2016-08-28 12:49:39 -04:00
..
adreno
drm/msm: deal with arbitrary # of cmd buffers
2016-07-16 10:09:08 -04:00
dsi
drm/msm/dsi: Fix return value check in msm_dsi_host_set_display_mode()
2016-07-16 10:29:28 -04:00
edp
drm: msm: Rely on the default ->best_encoder() behavior where appropriate
2016-06-09 08:43:26 +02:00
hdmi
drm/msm/hdmi: Delete an unnecessary check before the function call "kfree"
2016-07-16 10:29:33 -04:00
mdp
drm/msm: Delete unnecessary checks before drm_gem_object_unreference_unlocked()
2016-07-16 10:29:34 -04:00
Kconfig
drm: msm: Add ASoC generic hdmi audio codec support.
2016-07-16 10:29:00 -04:00
Makefile
drm/msm: shrinker support
2016-07-16 10:09:06 -04:00
msm_atomic.c
drm/atomic-helper: Massage swap_state signature somewhat
2016-06-10 16:52:12 +02:00
msm_debugfs.c
drm/msm: move debugfs code to it's own file
2016-05-08 10:16:02 -04:00
msm_debugfs.h
drm/msm: move debugfs code to it's own file
2016-05-08 10:16:02 -04:00
msm_drv.c
dma-mapping: use unsigned long for dma_attrs
2016-08-04 08:50:07 -04:00
msm_drv.h
drm/msm: protect against faults from copy_from_user() in submit ioctl
2016-08-28 12:49:39 -04:00
msm_fb.c
drm/msm: Delete unnecessary checks before drm_gem_object_unreference_unlocked()
2016-07-16 10:29:34 -04:00
msm_fbdev.c
drm/msm: change gem->vmap() to get/put
2016-07-16 10:09:07 -04:00
msm_fence.c
drm/msm: 'struct fence' conversion
2016-05-08 10:22:15 -04:00
msm_fence.h
drm/msm: 'struct fence' conversion
2016-05-08 10:22:15 -04:00
msm_gem_prime.c
drm/msm: change gem->vmap() to get/put
2016-07-16 10:09:07 -04:00
msm_gem_shrinker.c
drm/msm: wire up vmap shrinker
2016-07-16 10:09:07 -04:00
msm_gem_submit.c
drm/msm: protect against faults from copy_from_user() in submit ioctl
2016-08-28 12:49:39 -04:00
msm_gem.c
drm/msm: protect against faults from copy_from_user() in submit ioctl
2016-08-28 12:49:39 -04:00
msm_gem.h
drm/msm: deal with arbitrary # of cmd buffers
2016-07-16 10:09:08 -04:00
msm_gpu.c
drm/msm: print offender task name on hangcheck recovery
2016-05-08 10:22:18 -04:00
msm_gpu.h
drm/msm: drop return from gpu->submit()
2016-05-08 10:22:18 -04:00
msm_iommu.c
drm/msm: Print the correct virtual addresses in map/unmap funcs
2016-07-16 10:08:44 -04:00
msm_kms.h
drm/msm/mdp5: Remove old kms init/destroy funcs
2016-07-16 10:08:57 -04:00
msm_mmu.h
drm/msm: make iommu port names const'ier
2016-03-02 16:19:43 -05:00
msm_perf.c
drm/msm: return -EFAULT instead of bytes remaining
2016-07-16 10:29:32 -04:00
msm_rd.c
drm/msm: return -EFAULT instead of bytes remaining
2016-07-16 10:29:32 -04:00
msm_ringbuffer.c
drm/msm: change gem->vmap() to get/put
2016-07-16 10:09:07 -04:00
msm_ringbuffer.h
drm/msm: add a3xx gpu support
2013-08-24 14:57:18 -04:00
NOTES
drm/msm: add mdp5/apq8x74
2014-01-09 14:44:06 -05:00