iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/gpu/drm
History
Min Li 6eeb1cba4c drm/i915: fix race condition UAF in i915_perf_add_config_ioctl 
[ Upstream commit dc30c011469165d57af9adac5baff7d767d20e5c ]

Userspace can guess the id value and try to race oa_config object creation
with config remove, resulting in a use-after-free if we dereference the
object after unlocking the metrics_lock.  For that reason, unlocking the
metrics_lock must be done after we are done dereferencing the object.

Signed-off-by: Min Li <lm0963hack@gmail.com>
Fixes: f89823c21224 ("drm/i915/perf: Implement I915_PERF_ADD/REMOVE_CONFIG interface")
Cc: <stable@vger.kernel.org> # v4.14+
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230328093627.5067-1-lm0963hack@gmail.com
[tursulin: Manually added stable tag.]
(cherry picked from commit 49f6f6483b652108bcb73accd0204a464b922395)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-20 12:13:55 +02:00
..
amd
drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub
2023-04-05 11:25:01 +02:00
arm
malidp: Fix NULL vs IS_ERR() checking
2023-03-11 13:57:40 +01:00
armada
drm/armada: Fix a potential double free in an error handling path
2023-04-20 12:13:53 +02:00
aspeed
drm/aspeed: Fix vga_pw sysfs output
2021-12-01 09:04:47 +01:00
ast
drm/ast: Create threshold values for AST2600
2022-06-14 18:36:27 +02:00
atmel-hlcdc
drm/atmel-hlcdc: Convert to Linux IRQ interfaces
2021-08-10 20:00:58 +02:00
bridge
drm/bridge: lt9611: Fix PLL being unable to lock
2023-04-13 16:48:26 +02:00
etnaviv
drm/etnaviv: fix reference leak when mmaping imported buffer
2023-04-05 11:25:00 +02:00
exynos
drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags
2023-03-10 09:39:24 +01:00
fsl-dcu
drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid()
2022-12-31 13:14:44 +01:00
gma500
drm/gma500: Fix BUG: sleeping function called from invalid context errors
2022-09-28 11:11:55 +02:00
gud
drm/gud: Get offset-adjusted mapping from drm_gem_fb_vmap()
2021-08-08 20:27:24 +02:00
hisilicon
drm/hisilicon: Add depends on MMU
2022-09-28 11:11:50 +02:00
hyperv
drm/hyperv-drm: Include framebuffer and EDID headers
2022-08-17 14:22:53 +02:00
i2c
…
i810
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
i915
drm/i915: fix race condition UAF in i915_perf_add_config_ioctl
2023-04-20 12:13:55 +02:00
imx
drm/imx: ipuv3-plane: Fix overlay plane width
2023-01-12 11:59:15 +01:00
ingenic
drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init()
2023-01-12 11:59:00 +01:00
kmb
drm/kmb: Fix for build errors with Warray-bounds
2022-02-08 18:34:09 +01:00
lib
…
lima
drm/shmem-helper: Pass GEM shmem object in public interfaces
2022-08-17 14:23:19 +02:00
mcde
drm/mcde: Fix refcount leak in mcde_dsi_bind
2022-08-17 14:23:23 +02:00
mediatek
drm/mediatek: Clean dangling pointer on bind error path
2023-03-10 09:39:26 +01:00
meson
drm/meson: fix missing component unbind on bind errors
2023-03-30 12:47:59 +02:00
mga
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
mgag200
drm/mgag200: Fix PLL setup for G200_SE_A rev >=4
2023-01-12 11:59:20 +01:00
msm
drm/msm/dpu: fix len of sc7180 ctl blocks
2023-03-17 08:48:55 +01:00
mxsfb
drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
2023-03-10 09:39:19 +01:00
nouveau
drm/nouveau/disp: Support more modes by checking with lower bpc
2023-04-13 16:48:26 +02:00
omapdrm
drm/omap: dsi: Fix excessive stack usage
2023-03-10 09:39:52 +01:00
panel
drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags
2023-03-10 09:39:24 +01:00
panfrost
drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
2023-04-13 16:48:25 +02:00
pl111
drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node()
2022-10-26 12:34:51 +02:00
qxl
drm-misc-next for v5.15:
2021-07-21 11:58:28 +10:00
r128
drm/r128: fix build for UML
2021-10-15 15:05:10 +10:00
radeon
drm/radeon: Fix eDP for single-display iMac11,2
2023-03-10 09:40:14 +01:00
rcar-du
drm: rcar-du: Fix CRTC timings when CMM is used
2022-01-27 11:04:35 +01:00
rockchip
drm/rockchip: Use drm_mode_copy()
2022-12-31 13:14:42 +01:00
savage
…
scheduler
drm/sched: Allow using a dedicated workqueue for the timeout/fault tdr
2021-07-01 08:53:25 +02:00
selftests
drm/selftests/test-drm_dp_mst_helper: Fix memory leak in sideband_msg_req_encode_decode
2022-04-08 14:23:24 +02:00
shmobile
drm/shmobile: Convert to Linux IRQ interfaces
2021-07-25 11:01:12 +02:00
sis
…
sti
drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()
2022-12-31 13:14:44 +01:00
stm
stm: ltdc: fix two incorrect NULL checks on list iterator
2022-06-09 10:23:28 +02:00
sun4i
drm/sun4i: fix missing component unbind on bind errors
2023-03-22 13:31:34 +01:00
tdfx
…
tegra
drm/tegra: firewall: Check for is_addr_reg existence in IMM check
2023-03-10 09:39:26 +01:00
tidss
drm: tidss: Fix pixel format definition
2023-03-10 09:39:20 +01:00
tilcdc
tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator
2022-06-09 10:23:29 +02:00
tiny
drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update()
2023-03-30 12:47:52 +02:00
ttm
drm/ttm: Fix dummy res NULL ptr deref bug
2022-08-25 11:39:54 +02:00
tve200
drm/tiny: drm_gem_simple_display_pipe_prepare_fb is the default
2021-06-24 15:40:11 +02:00
udl
drm/udl: Restore display mode on resume
2022-10-26 12:34:24 +02:00
v3d
drm/shmem-helper: Pass GEM shmem object in public interfaces
2022-08-17 14:23:19 +02:00
vboxvideo
drm/vboxvideo: fix a NULL vs IS_ERR() check
2022-01-27 11:03:13 +01:00
vc4
drm/vc4: hdmi: Correct interlaced timings again
2023-03-10 09:39:21 +01:00
vgem
Revert "drm/vgem: Implement mmap as GEM object function"
2021-07-13 13:15:52 +02:00
via
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
virtio
drm/virtio: Fix error code in virtio_gpu_object_shmem_init()
2023-03-11 13:57:40 +01:00
vkms
drm/vkms: Fix null-ptr-deref in vkms_release()
2023-03-10 09:39:20 +01:00
vmwgfx
treewide: fix up files incorrectly marked executable
2023-02-01 08:27:29 +01:00
xen
drm/tiny: drm_gem_simple_display_pipe_prepare_fb is the default
2021-06-24 15:40:11 +02:00
xlnx
drm/xlnx/zynqmp_disp: Fix incorrectly named enum 'zynqmp_disp_layer_id'
2021-08-09 02:28:05 +03:00
zte
drm/zte: Don't set struct drm_device.irq_enabled
2021-06-29 15:40:53 +02:00
drm_agpsupport.c
…
drm_aperture.c
drm/aperture: Run fbdev removal before internal helpers
2022-07-21 21:24:44 +02:00
drm_atomic_helper.c
drm/atomic: Force bridge self-refresh-exit on CRTC switch
2022-06-14 18:36:27 +02:00
drm_atomic_state_helper.c
…
drm_atomic_uapi.c
drm/atomic: Don't pollute crtc_state->mode_blob with error pointers
2022-02-23 12:03:08 +01:00
drm_atomic.c
drm/connector: print max_requested_bpc in state debugfs
2023-03-17 08:48:47 +01:00
drm_auth.c
drm: add lockdep assert to drm_is_current_master_locked
2021-08-05 12:08:15 +02:00
drm_blend.c
…
drm_bridge_connector.c
drm/bridge_connector: enable HPD by default if supported
2022-06-09 10:22:44 +02:00
drm_bridge.c
drm/bridge: Avoid uninitialized variable warning
2022-10-26 12:34:50 +02:00
drm_bufs.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_cache.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_client_modeset.c
…
drm_client.c
…
drm_color_mgmt.c
…
drm_connector.c
drm/connector: send hotplug uevent on connector cleanup
2023-01-12 11:58:59 +01:00
drm_context.c
…
drm_crtc_helper_internal.h
…
drm_crtc_helper.c
…
drm_crtc_internal.h
Backmerge remote-tracking branch 'drm/drm-next' into drm-misc-next
2021-07-27 12:48:17 +02:00
drm_crtc.c
…
drm_damage_helper.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_debugfs_crc.c
drm/doc: document how userspace should find out CRTC index
2021-06-10 19:14:47 +02:00
drm_debugfs.c
drm: avoid blocking in drm_clients_info's rcu section
2021-07-20 20:14:42 +02:00
drm_displayid.c
…
drm_dma.c
…
drm_dp_aux_bus.c
drm/dp: Export symbol / kerneldoc fixes for DP AUX bus
2022-08-17 14:23:16 +02:00
drm_dp_aux_dev.c
…
drm_dp_cec.c
…
drm_dp_dual_mode_helper.c
drm/display: Don't assume dual mode adaptors support i2c sub-addressing
2022-12-02 17:41:00 +01:00
drm_dp_helper.c
drm/dp: Don't rewrite link config when setting phy test pattern
2022-10-26 12:35:42 +02:00
drm_dp_mst_topology_internal.h
…
drm_dp_mst_topology.c
drm/display/dp_mst: Fix down message handling after a packet reception error
2023-03-11 13:57:39 +01:00
drm_drv.c
drm/drv: Fix potential memory leak in drm_dev_init()
2022-11-26 09:24:36 +01:00
drm_dsc.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_dumb_buffers.c
…
drm_edid_load.c
…
drm_edid.c
drm/edid: fix AVI infoframe aspect ratio handling
2023-03-10 09:40:14 +01:00
drm_encoder_slave.c
…
drm_encoder.c
…
drm_fb_cma_helper.c
drm: Add and export function drm_fb_cma_sync_non_coherent
2021-05-25 11:42:09 +01:00
drm_fb_helper.c
drm/fb-helper: Mark screen buffers in system memory with FBINFO_VIRTFB
2022-04-08 14:23:03 +02:00
drm_file.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_flip_work.c
…
drm_format_helper.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_fourcc.c
drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
2023-03-10 09:39:19 +01:00
drm_framebuffer.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_gem_atomic_helper.c
drm/gem: Provide offset-adjusted framebuffer BO mappings
2021-08-08 20:26:16 +02:00
drm_gem_cma_helper.c
drm/cma-helper: Set VM_DONTEXPAND for mmap
2022-02-23 12:03:09 +01:00
drm_gem_framebuffer_helper.c
drm/gem: Provide offset-adjusted framebuffer BO mappings
2021-08-08 20:26:16 +02:00
drm_gem_shmem_helper.c
drm/shmem-helper: Remove another errant put in error path
2023-03-22 13:31:34 +01:00
drm_gem_ttm_helper.c
drm/ttm: fix locking in vmap/vunmap TTM GEM helpers
2022-07-29 17:25:05 +02:00
drm_gem_vram_helper.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_gem.c
drm/gem: Fix GEM handle release errors
2022-09-15 11:30:01 +02:00
drm_hashtab.c
…
drm_hdcp.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_internal.h
drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()
2022-11-26 09:24:37 +01:00
drm_ioc32.c
drm: Copy drm_wait_vblank to user before returning
2021-08-17 13:56:03 -04:00
drm_ioctl.c
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
2022-10-26 12:35:38 +02:00
drm_irq.c
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
drm_kms_helper_common.c
…
drm_lease.c
drm: clean up unused kerneldoc in drm_lease.c
2021-07-30 11:55:41 +02:00
drm_legacy_misc.c
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
drm_legacy.h
…
drm_lock.c
…
drm_managed.c
…
drm_memory.c
…
drm_mipi_dbi.c
drm/mipi-dbi: align max_chunk to 2 in spi_transfer
2022-08-17 14:23:17 +02:00
drm_mipi_dsi.c
drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
2023-03-10 09:39:24 +01:00
drm_mm.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_mode_config.c
drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
2023-03-10 09:39:19 +01:00
drm_mode_object.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_modes.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_modeset_helper.c
…
drm_modeset_lock.c
…
drm_of.c
drm/bridge: Add a function to abstract away panels
2022-08-17 14:23:24 +02:00
drm_panel_orientation_quirks.c
drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F
2023-04-20 12:13:54 +02:00
drm_panel.c
drm/dp: Move panel DP AUX backlight support to drm_dp_helper
2021-07-13 06:38:37 -07:00
drm_pci.c
…
drm_plane_helper.c
drm/plane-helper: fix uninitialized variable reference
2021-11-18 19:17:00 +01:00
drm_plane.c
drm/plane: Move range check for format_count earlier
2022-06-09 10:22:34 +02:00
drm_prime.c
drm/gem: Fix GEM handle release errors
2022-09-15 11:30:01 +02:00
drm_print.c
isystem: ship and use stdarg.h
2021-08-19 09:02:55 +09:00
drm_probe_helper.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_property.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_rect.c
…
drm_scatter.c
…
drm_scdc_helper.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_self_refresh_helper.c
…
drm_simple_kms_helper.c
drm/simple-kms: Support custom CRTC state
2021-08-08 20:14:08 +02:00
drm_syncobj.c
drm/syncobj: flatten dma_fence_chains on transfer
2022-04-08 14:23:03 +02:00
drm_sysfs.c
…
drm_trace_points.c
…
drm_trace.h
…
drm_vblank_work.c
…
drm_vblank.c
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
drm_vm.c
…
drm_vma_manager.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_writeback.c
…
Kconfig
Revert "drm: fb_helper: fix CONFIG_FB dependency"
2021-11-21 13:44:12 +01:00
Makefile
drm/bochs: Move to tiny/
2021-07-05 08:54:44 +02:00