iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/gpu/drm
History
Rob Clark e3ebc3e23b drm/i915: Fix potential bit_17 double-free 
commit 7057a8f126f14f14b040faecfa220fd27c6c2f85 upstream.

A userspace with multiple threads racing I915_GEM_SET_TILING to set the
tiling to I915_TILING_NONE could trigger a double free of the bit_17
bitmask.  (Or conversely leak memory on the transition to tiled.)  Move
allocation/free'ing of the bitmask within the section protected by the
obj lock.

Signed-off-by: Rob Clark <robdclark@chromium.org>
Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex")
Cc: <stable@vger.kernel.org> # v5.5+
[tursulin: Correct fixes tag and added cc stable.]
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230127200550.3531984-1-robdclark@gmail.com
(cherry picked from commit 10e0cbaaf1104f449d695c80bcacf930dcd3c42e)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-02-09 11:26:45 +01:00
..
amd
drm/amd/display: Fix timing not changning when freesync video is enabled
2023-02-09 11:26:40 +01:00
arm
drm/komeda: Fix handling of atomic commits in the atomic_commit_tail hook
2022-10-26 12:35:38 +02:00
armada
gup: Turn fault_in_pages_{readable,writeable} into fault_in_{readable,writeable}
2022-05-01 17:22:28 +02:00
aspeed
drm/aspeed: Fix vga_pw sysfs output
2021-12-01 09:04:47 +01:00
ast
drm/ast: Create threshold values for AST2600
2022-06-14 18:36:27 +02:00
atmel-hlcdc
drm/atmel-hlcdc: Convert to Linux IRQ interfaces
2021-08-10 20:00:58 +02:00
bridge
drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge
2022-12-31 13:14:06 +01:00
etnaviv
drm/etnaviv: add missing quirks for GC300
2022-12-31 13:14:40 +01:00
exynos
drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed.
2022-08-17 14:23:30 +02:00
fsl-dcu
drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid()
2022-12-31 13:14:44 +01:00
gma500
drm/gma500: Fix BUG: sleeping function called from invalid context errors
2022-09-28 11:11:55 +02:00
gud
drm/gud: Get offset-adjusted mapping from drm_gem_fb_vmap()
2021-08-08 20:27:24 +02:00
hisilicon
drm/hisilicon: Add depends on MMU
2022-09-28 11:11:50 +02:00
hyperv
drm/hyperv-drm: Include framebuffer and EDID headers
2022-08-17 14:22:53 +02:00
i2c
…
i810
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
i915
drm/i915: Fix potential bit_17 double-free
2023-02-09 11:26:45 +01:00
imx
drm/imx: ipuv3-plane: Fix overlay plane width
2023-01-12 11:59:15 +01:00
ingenic
drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init()
2023-01-12 11:59:00 +01:00
kmb
drm/kmb: Fix for build errors with Warray-bounds
2022-02-08 18:34:09 +01:00
lib
…
lima
drm/shmem-helper: Pass GEM shmem object in public interfaces
2022-08-17 14:23:19 +02:00
mcde
drm/mcde: Fix refcount leak in mcde_dsi_bind
2022-08-17 14:23:23 +02:00
mediatek
drm/mediatek: Fix return type of mtk_hdmi_bridge_mode_valid()
2022-12-31 13:14:42 +01:00
meson
drm/meson: Reduce the FIFO lines held when AFBC is not used
2023-01-12 11:59:14 +01:00
mga
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
mgag200
drm/mgag200: Fix PLL setup for G200_SE_A rev >=4
2023-01-12 11:59:20 +01:00
msm
drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer
2023-01-18 11:48:51 +01:00
mxsfb
drm: mxsfb: Fix NULL pointer dereference
2022-03-08 19:12:40 +01:00
nouveau
drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
2022-10-26 12:35:38 +02:00
omapdrm
drm/omap: dss: Fix refcount leak bugs
2022-10-26 12:34:54 +02:00
panel
drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure
2022-12-31 13:14:08 +01:00
panfrost
drm/panfrost: fix GENERIC_ATOMIC64 dependency
2023-02-01 08:27:12 +01:00
pl111
drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node()
2022-10-26 12:34:51 +02:00
qxl
drm-misc-next for v5.15:
2021-07-21 11:58:28 +10:00
r128
drm/r128: fix build for UML
2021-10-15 15:05:10 +10:00
radeon
drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
2022-12-31 13:14:14 +01:00
rcar-du
drm: rcar-du: Fix CRTC timings when CMM is used
2022-01-27 11:04:35 +01:00
rockchip
drm/rockchip: Use drm_mode_copy()
2022-12-31 13:14:42 +01:00
savage
…
scheduler
drm/sched: Allow using a dedicated workqueue for the timeout/fault tdr
2021-07-01 08:53:25 +02:00
selftests
drm/selftests/test-drm_dp_mst_helper: Fix memory leak in sideband_msg_req_encode_decode
2022-04-08 14:23:24 +02:00
shmobile
drm/shmobile: Convert to Linux IRQ interfaces
2021-07-25 11:01:12 +02:00
sis
…
sti
drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()
2022-12-31 13:14:44 +01:00
stm
stm: ltdc: fix two incorrect NULL checks on list iterator
2022-06-09 10:23:28 +02:00
sun4i
drm/sun4i: dsi: Prevent underflow when computing packet sizes
2022-08-25 11:40:29 +02:00
tdfx
…
tegra
drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe()
2022-12-31 13:14:13 +01:00
tidss
drm/tidss: Convert to Linux IRQ interfaces
2021-08-10 20:13:49 +02:00
tilcdc
tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator
2022-06-09 10:23:29 +02:00
tiny
drm/bochs: fix blanking
2022-10-26 12:34:54 +02:00
ttm
drm/ttm: Fix dummy res NULL ptr deref bug
2022-08-25 11:39:54 +02:00
tve200
drm/tiny: drm_gem_simple_display_pipe_prepare_fb is the default
2021-06-24 15:40:11 +02:00
udl
drm/udl: Restore display mode on resume
2022-10-26 12:34:24 +02:00
v3d
drm/shmem-helper: Pass GEM shmem object in public interfaces
2022-08-17 14:23:19 +02:00
vboxvideo
drm/vboxvideo: fix a NULL vs IS_ERR() check
2022-01-27 11:03:13 +01:00
vc4
drm/vc4: hdmi: make CEC adapter name unique
2023-02-09 11:26:34 +01:00
vgem
Revert "drm/vgem: Implement mmap as GEM object function"
2021-07-13 13:15:52 +02:00
via
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
virtio
drm/virtio: Fix GEM handle creation UAF
2023-01-18 11:48:49 +01:00
vkms
drm/vkms: Use offset-adjusted shadow-plane mappings and output
2021-08-08 20:27:52 +02:00
vmwgfx
treewide: fix up files incorrectly marked executable
2023-02-01 08:27:29 +01:00
xen
drm/tiny: drm_gem_simple_display_pipe_prepare_fb is the default
2021-06-24 15:40:11 +02:00
xlnx
drm/xlnx/zynqmp_disp: Fix incorrectly named enum 'zynqmp_disp_layer_id'
2021-08-09 02:28:05 +03:00
zte
drm/zte: Don't set struct drm_device.irq_enabled
2021-06-29 15:40:53 +02:00
drm_agpsupport.c
…
drm_aperture.c
drm/aperture: Run fbdev removal before internal helpers
2022-07-21 21:24:44 +02:00
drm_atomic_helper.c
drm/atomic: Force bridge self-refresh-exit on CRTC switch
2022-06-14 18:36:27 +02:00
drm_atomic_state_helper.c
…
drm_atomic_uapi.c
drm/atomic: Don't pollute crtc_state->mode_blob with error pointers
2022-02-23 12:03:08 +01:00
drm_atomic.c
drm/atomic: Add the crtc to affected crtc only if uapi.enable = true
2022-02-01 17:27:01 +01:00
drm_auth.c
drm: add lockdep assert to drm_is_current_master_locked
2021-08-05 12:08:15 +02:00
drm_blend.c
…
drm_bridge_connector.c
drm/bridge_connector: enable HPD by default if supported
2022-06-09 10:22:44 +02:00
drm_bridge.c
drm/bridge: Avoid uninitialized variable warning
2022-10-26 12:34:50 +02:00
drm_bufs.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_cache.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_client_modeset.c
…
drm_client.c
…
drm_color_mgmt.c
…
drm_connector.c
drm/connector: send hotplug uevent on connector cleanup
2023-01-12 11:58:59 +01:00
drm_context.c
…
drm_crtc_helper_internal.h
…
drm_crtc_helper.c
…
drm_crtc_internal.h
Backmerge remote-tracking branch 'drm/drm-next' into drm-misc-next
2021-07-27 12:48:17 +02:00
drm_crtc.c
…
drm_damage_helper.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_debugfs_crc.c
drm/doc: document how userspace should find out CRTC index
2021-06-10 19:14:47 +02:00
drm_debugfs.c
drm: avoid blocking in drm_clients_info's rcu section
2021-07-20 20:14:42 +02:00
drm_displayid.c
…
drm_dma.c
…
drm_dp_aux_bus.c
drm/dp: Export symbol / kerneldoc fixes for DP AUX bus
2022-08-17 14:23:16 +02:00
drm_dp_aux_dev.c
…
drm_dp_cec.c
…
drm_dp_dual_mode_helper.c
drm/display: Don't assume dual mode adaptors support i2c sub-addressing
2022-12-02 17:41:00 +01:00
drm_dp_helper.c
drm/dp: Don't rewrite link config when setting phy test pattern
2022-10-26 12:35:42 +02:00
drm_dp_mst_topology_internal.h
…
drm_dp_mst_topology.c
drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code
2022-12-08 11:28:38 +01:00
drm_drv.c
drm/drv: Fix potential memory leak in drm_dev_init()
2022-11-26 09:24:36 +01:00
drm_dsc.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_dumb_buffers.c
…
drm_edid_load.c
…
drm_edid.c
drm/edid: fix invalid EDID extension block filtering
2022-06-09 10:22:44 +02:00
drm_encoder_slave.c
…
drm_encoder.c
…
drm_fb_cma_helper.c
drm: Add and export function drm_fb_cma_sync_non_coherent
2021-05-25 11:42:09 +01:00
drm_fb_helper.c
drm/fb-helper: Mark screen buffers in system memory with FBINFO_VIRTFB
2022-04-08 14:23:03 +02:00
drm_file.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_flip_work.c
…
drm_format_helper.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_fourcc.c
drm/fourcc: Fix vsub/hsub for Q410 and Q401
2022-12-31 13:14:10 +01:00
drm_framebuffer.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_gem_atomic_helper.c
drm/gem: Provide offset-adjusted framebuffer BO mappings
2021-08-08 20:26:16 +02:00
drm_gem_cma_helper.c
drm/cma-helper: Set VM_DONTEXPAND for mmap
2022-02-23 12:03:09 +01:00
drm_gem_framebuffer_helper.c
drm/gem: Provide offset-adjusted framebuffer BO mappings
2021-08-08 20:26:16 +02:00
drm_gem_shmem_helper.c
drm/shmem-helper: Avoid vm_open error paths
2022-12-14 11:37:21 +01:00
drm_gem_ttm_helper.c
drm/ttm: fix locking in vmap/vunmap TTM GEM helpers
2022-07-29 17:25:05 +02:00
drm_gem_vram_helper.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_gem.c
drm/gem: Fix GEM handle release errors
2022-09-15 11:30:01 +02:00
drm_hashtab.c
…
drm_hdcp.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_internal.h
drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()
2022-11-26 09:24:37 +01:00
drm_ioc32.c
drm: Copy drm_wait_vblank to user before returning
2021-08-17 13:56:03 -04:00
drm_ioctl.c
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
2022-10-26 12:35:38 +02:00
drm_irq.c
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
drm_kms_helper_common.c
…
drm_lease.c
drm: clean up unused kerneldoc in drm_lease.c
2021-07-30 11:55:41 +02:00
drm_legacy_misc.c
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
drm_legacy.h
…
drm_lock.c
…
drm_managed.c
…
drm_memory.c
…
drm_mipi_dbi.c
drm/mipi-dbi: align max_chunk to 2 in spi_transfer
2022-08-17 14:23:17 +02:00
drm_mipi_dsi.c
drm/mipi-dsi: Detach devices when removing the host
2022-10-26 12:34:50 +02:00
drm_mm.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_mode_config.c
…
drm_mode_object.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_modes.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_modeset_helper.c
…
drm_modeset_lock.c
…
drm_of.c
drm/bridge: Add a function to abstract away panels
2022-08-17 14:23:24 +02:00
drm_panel_orientation_quirks.c
drm: Add orientation quirk for Lenovo ideapad D330-10IGL
2023-02-01 08:27:17 +01:00
drm_panel.c
drm/dp: Move panel DP AUX backlight support to drm_dp_helper
2021-07-13 06:38:37 -07:00
drm_pci.c
…
drm_plane_helper.c
drm/plane-helper: fix uninitialized variable reference
2021-11-18 19:17:00 +01:00
drm_plane.c
drm/plane: Move range check for format_count earlier
2022-06-09 10:22:34 +02:00
drm_prime.c
drm/gem: Fix GEM handle release errors
2022-09-15 11:30:01 +02:00
drm_print.c
isystem: ship and use stdarg.h
2021-08-19 09:02:55 +09:00
drm_probe_helper.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_property.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_rect.c
…
drm_scatter.c
…
drm_scdc_helper.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_self_refresh_helper.c
…
drm_simple_kms_helper.c
drm/simple-kms: Support custom CRTC state
2021-08-08 20:14:08 +02:00
drm_syncobj.c
drm/syncobj: flatten dma_fence_chains on transfer
2022-04-08 14:23:03 +02:00
drm_sysfs.c
…
drm_trace_points.c
…
drm_trace.h
…
drm_vblank_work.c
…
drm_vblank.c
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
drm_vm.c
…
drm_vma_manager.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_writeback.c
…
Kconfig
Revert "drm: fb_helper: fix CONFIG_FB dependency"
2021-11-21 13:44:12 +01:00
Makefile
drm/bochs: Move to tiny/
2021-07-05 08:54:44 +02:00