iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
v6.1.36
linux/drivers/gpu/drm
History
Min Li 1af1cd7be3 drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl 
[ Upstream commit 982b173a6c6d9472730c3116051977e05d17c8c5 ]

Userspace can race to free the gobj(robj converted from), robj should not
be accessed again after drm_gem_object_put, otherwith it will result in
use-after-free.

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Min Li <lm0963hack@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-28 11:12:39 +02:00
..
amd
drm/amd/display: fix the system hang while disable PSR
2023-06-28 11:12:16 +02:00
arm
drm/gem: rename struct drm_gem_dma_object.{paddr => dma_addr}
2022-08-03 18:32:27 +02:00
armada
drm/armada: Fix a potential double free in an error handling path
2023-04-20 12:35:09 +02:00
aspeed
drm/gem: rename struct drm_gem_dma_object.{paddr => dma_addr}
2022-08-03 18:32:27 +02:00
ast
drm/ast: Fix ARM compatibility
2023-06-09 10:34:07 +02:00
atmel-hlcdc
drm/gem: rename struct drm_gem_dma_object.{paddr => dma_addr}
2022-08-03 18:32:27 +02:00
bridge
drm/bridge: ti-sn65dsi86: Avoid possible buffer overflow
2023-06-21 16:01:00 +02:00
display
drm/display/dp_mst: Handle old/new payload states in drm_dp_remove_payload()
2023-04-13 16:55:37 +02:00
etnaviv
drm/etnaviv: fix reference leak when mmaping imported buffer
2023-04-06 12:10:55 +02:00
exynos
drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl
2023-06-28 11:12:39 +02:00
fsl-dcu
drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid()
2022-12-31 13:33:06 +01:00
gma500
drm pull for 6.1-rc1
2022-10-05 11:24:12 -07:00
gud
drm/gud: Fix UBSAN warning
2023-03-10 09:34:33 +01:00
hisilicon
drm pull for 6.1-rc1
2022-10-05 11:24:12 -07:00
hyperv
hyperv-next for 6.1
2022-10-10 13:59:01 -07:00
i2c
i2c: Make remove callback return void
2022-08-16 12:46:26 +02:00
i810
…
i915
drm/i915/gt: Use the correct error value when kernel_context() fails
2023-06-14 11:15:25 +02:00
imx
drm/imx: ipuv3-plane: Fix overlay plane width
2023-01-12 12:02:27 +01:00
ingenic
drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init()
2023-01-07 11:11:57 +01:00
kmb
drm/gem: rename GEM CMA helpers to GEM DMA helpers
2022-08-03 18:31:49 +02:00
lib
…
lima
drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe()
2023-05-11 23:03:12 +09:00
logicvc
drm/gem: rename GEM CMA helpers to GEM DMA helpers
2022-08-03 18:31:49 +02:00
mcde
drm/gem: rename GEM CMA helpers to GEM DMA helpers
2022-08-03 18:31:49 +02:00
mediatek
drm/mediatek: dp: Change the aux retries times when receiving AUX_DEFER
2023-05-11 23:03:12 +09:00
meson
drm/meson: fix missing component unbind on bind errors
2023-03-30 12:49:27 +02:00
mga
…
mgag200
drm/mgag200: Fix gamma lut not initialized.
2023-05-30 14:03:19 +01:00
msm
drm/msm: Be more shouty if per-process pgtables aren't working
2023-06-09 10:34:16 +02:00
mxsfb
drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
2023-03-10 09:33:09 +01:00
nouveau
drm/nouveau: add nv_encoder pointer check for NULL
2023-06-21 16:01:01 +02:00
omapdrm
drm/omap: dsi: Fix excessive stack usage
2023-03-10 09:33:55 +01:00
panel
drm/panel: otm8009a: Set backlight parent to panel device
2023-05-17 11:53:48 +02:00
panfrost
drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
2023-04-13 16:55:35 +02:00
pl111
drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node()
2022-08-11 18:13:31 +02:00
qxl
drm/qxl: drop set_prod_notify parameter from qxl_ring_create
2022-09-23 13:16:37 +02:00
r128
drm/r128: Fix undefined behavior due to shift overflowing the constant
2022-05-21 18:02:47 +02:00
radeon
drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl
2023-06-28 11:12:39 +02:00
rcar-du
drm: rcar-du: Fix a NULL vs IS_ERR() bug
2023-05-11 23:03:11 +09:00
rockchip
drm/rockchip: dw_hdmi: cleanup drm encoder during unbind
2023-05-24 17:32:35 +01:00
savage
…
scheduler
drm/scheduler: fix fence ref counting
2022-10-25 13:14:36 +02:00
shmobile
drm/plane: Remove drm_plane_init()
2022-09-20 09:37:12 +02:00
sis
drm/sis: use idr_init_base() to initialize dev_priv->object_idr
2022-07-28 15:35:56 +01:00
solomon
drm/ssd130x: Init display before the SSD130X_DISPLAY_ON command
2023-02-09 11:28:02 +01:00
sprd
drm/gem: rename struct drm_gem_dma_object.{paddr => dma_addr}
2022-08-03 18:32:27 +02:00
sti
drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()
2022-12-31 13:33:06 +01:00
stm
drm/gem: rename GEM CMA helpers to GEM DMA helpers
2022-08-03 18:31:49 +02:00
sun4i
drm/sun4i: fix missing component unbind on bind errors
2023-03-22 13:34:00 +01:00
tdfx
…
tegra
drm/tegra: Avoid potential 32-bit integer overflow
2023-05-24 17:32:35 +01:00
tests
drm: test: Fix 32-bit issue in drm_buddy_test
2023-04-26 14:28:36 +02:00
tidss
drm: tidss: Fix pixel format definition
2023-03-10 09:33:09 +01:00
tilcdc
drm/plane: Remove drm_plane_init()
2022-09-20 09:37:12 +02:00
tiny
drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update()
2023-03-30 12:49:16 +02:00
ttm
drm/ttm/pool: Fix ttm_pool_alloc error path
2023-05-11 23:03:13 +09:00
tve200
drm/tve200: Fix smatch warning
2022-08-26 14:22:59 +02:00
udl
drm/udl: Sync pending URBs at the end of suspend
2022-09-10 21:45:53 +02:00
v3d
drm/gem: rename GEM CMA helpers to GEM DMA helpers
2022-08-03 18:31:49 +02:00
vboxvideo
drm/vboxvideo: fix repeated words in comments
2022-09-17 15:01:24 +02:00
vc4
drm/vc4: hdmi: Correct interlaced timings again
2023-03-10 09:33:11 +01:00
vgem
drm/vgem: add missing mutex_destroy
2023-05-11 23:03:07 +09:00
via
drm/via: Add new condition to via_dma_cleanup()
2022-09-07 07:01:16 +02:00
virtio
drm/virtio: Pass correct device to dma_sync_sgtable_for_device()
2023-03-22 13:33:39 +01:00
vkms
drm/vkms: Fix null-ptr-deref in vkms_release()
2023-03-10 09:33:09 +01:00
vmwgfx
drm/vmwgfx: Fix Legacy Display Unit atomic drm support
2023-05-17 11:53:27 +02:00
xen
Linux 5.19-rc6
2022-07-13 10:54:56 +10:00
xlnx
drm/gem: rename struct drm_gem_dma_object.{paddr => dma_addr}
2022-08-03 18:32:27 +02:00
drm_agpsupport.c
…
drm_aperture.c
drm/aperture: Fix some kerneldoc comments
2022-09-12 09:34:07 +02:00
drm_atomic_helper.c
drm/atomic-helper: Don't allocate new plane state in CRTC check
2022-12-31 13:32:01 +01:00
drm_atomic_state_helper.c
drm: Drop drm_blend.h from drm_crtc.h
2022-06-20 23:53:55 +03:00
drm_atomic_uapi.c
drm: Drop drm_framebuffer.h from drm_crtc.h
2022-06-20 23:53:55 +03:00
drm_atomic.c
drm/connector: print max_requested_bpc in state debugfs
2023-03-17 08:50:15 +01:00
drm_auth.c
drm: use idr_init_base() to initialize master->lessee_idr
2022-07-28 15:35:55 +01:00
drm_blend.c
drm/doc: Fix comment typo
2022-06-28 07:56:32 +02:00
drm_bridge_connector.c
drm: Config orientation property if panel provides it
2022-06-21 08:52:59 -07:00
drm_bridge.c
drm/bridge: Avoid uninitialized variable warning
2022-07-08 13:41:28 +02:00
drm_buddy.c
drm: buddy_allocator: Fix buddy allocator init on 32-bit systems
2023-04-26 14:28:36 +02:00
drm_bufs.c
…
drm_cache.c
…
drm_client_modeset.c
drm: Drop drm_edid.h from drm_crtc.h
2022-06-20 23:53:55 +03:00
drm_client.c
drm/client: Use actual bpp when allocating frame buffers
2022-07-09 15:00:52 +02:00
drm_color_mgmt.c
drm: fix whitespace in drm_plane_create_color_properties()
2022-08-04 15:24:46 +02:00
drm_connector.c
drm/connector: send hotplug uevent on connector cleanup
2023-01-07 11:11:56 +01:00
drm_context.c
…
drm_crtc_helper_internal.h
…
drm_crtc_helper.c
Driver core changes for 6.1-rc1
2022-10-07 17:04:10 -07:00
drm_crtc_internal.h
drm/edid: abstract debugfs override EDID set/reset
2022-06-30 10:50:59 +03:00
drm_crtc.c
drm/crtc: Introduce drmm_crtc_init_with_planes
2022-07-13 10:46:05 +02:00
drm_damage_helper.c
drm: Use original src rect while initializing damage iterator
2022-09-13 14:38:33 +03:00
drm_debugfs_crc.c
…
drm_debugfs.c
drm/edid: Handle EDID 1.4 range descriptor h/vfreq offsets
2022-09-02 16:38:51 +03:00
drm_displayid.c
drm/displayid: add displayid_get_header() and check bounds better
2023-05-24 17:32:34 +01:00
drm_dma.c
…
drm_drv.c
drm/drv: Fix potential memory leak in drm_dev_init()
2022-11-10 18:49:01 -05:00
drm_dumb_buffers.c
…
drm_edid_load.c
…
drm_edid.c
drm/edid: fix parsing of 3D modes from HDMI VSDB
2023-03-10 09:34:33 +01:00
drm_encoder_slave.c
…
drm_encoder.c
drm/encoder: Introduce drmm_encoder_init
2022-07-13 10:46:05 +02:00
drm_fb_dma_helper.c
drm/gem: rename struct drm_gem_dma_object.{paddr => dma_addr}
2022-08-03 18:32:27 +02:00
drm_fb_helper.c
drm/fbdev-generic: prohibit potential out-of-bounds access
2023-05-24 17:32:31 +01:00
drm_file.c
drm-misc-next for v6.1:
2022-09-06 10:56:04 +02:00
drm_flip_work.c
…
drm_format_helper.c
drm/format-helper: Only advertise supported formats for conversion
2022-10-31 09:50:44 +01:00
drm_fourcc.c
drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
2023-03-10 09:33:08 +01:00
drm_framebuffer.c
drm/framebuffer: convert to drm_dbg_kms()
2022-09-28 10:43:30 +02:00
drm_gem_atomic_helper.c
drm: Drop drm_framebuffer.h from drm_crtc.h
2022-06-20 23:53:55 +03:00
drm_gem_dma_helper.c
drm/gem: rename struct drm_gem_dma_object.{paddr => dma_addr}
2022-08-03 18:32:27 +02:00
drm_gem_framebuffer_helper.c
drm/gem-fb-helper: Use actual bpp for size calculations
2022-07-09 15:08:16 +02:00
drm_gem_shmem_helper.c
drm/shmem-helper: Remove another errant put in error path
2023-03-22 13:34:00 +01:00
drm_gem_ttm_helper.c
drm/ttm: fix locking in vmap/vunmap TTM GEM helpers
2022-07-18 09:18:53 +02:00
drm_gem_vram_helper.c
drm/ttm: rename and cleanup ttm_bo_init
2022-07-11 10:53:13 +02:00
drm_gem.c
drm/msm/gem: Prevent blocking within shrinker loop
2023-03-22 13:33:39 +01:00
drm_hashtab.c
…
drm_internal.h
drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()
2022-11-10 18:49:02 -05:00
drm_ioc32.c
…
drm_ioctl.c
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
2022-07-15 10:25:36 +02:00
drm_irq.c
…
drm_kms_helper_common.c
drm: Drop drm_edid.h from drm_crtc.h
2022-06-20 23:53:55 +03:00
drm_lease.c
…
drm_legacy_misc.c
…
drm_legacy.h
…
drm_lock.c
…
drm_managed.c
drm: fix drmm_mutex_init()
2023-05-30 14:03:20 +01:00
drm_memory.c
…
drm_mipi_dbi.c
drm/probe-helper: Add drm_crtc_helper_mode_valid_fixed()
2022-09-12 09:14:26 +02:00
drm_mipi_dsi.c
drm/mipi-dsi: Set the fwnode for mipi_dsi_device
2023-05-24 17:32:31 +01:00
drm_mm.c
…
drm_mode_config.c
drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
2023-03-10 09:33:08 +01:00
drm_mode_object.c
…
drm_modes.c
drm: Remove linux/fb.h from drm_crtc.h
2022-07-05 21:14:02 +03:00
drm_modeset_helper.c
drm/plane-helper: Provide DRM_PLANE_NON_ATOMIC_FUNCS initializer macro
2022-09-20 09:42:31 +02:00
drm_modeset_lock.c
…
drm_nomodeset.c
…
drm_of.c
drm: Remove linux/media-bus-format.h from drm_crtc.h
2022-07-05 21:15:13 +03:00
drm_panel_orientation_quirks.c
drm: panel-orientation-quirks: Change Air's quirk to support Air Plus
2023-06-21 16:00:52 +02:00
drm_panel.c
…
drm_pci.c
…
drm_plane_helper.c
drm/plane-helper: Warn if atomic drivers call non-atomic helpers
2022-09-20 09:42:31 +02:00
drm_plane.c
drm/plane: Allocate planes with drm_universal_plane_alloc()
2022-09-20 09:41:06 +02:00
drm_prime.c
drm/gem: Fix GEM handle release errors
2022-08-19 13:38:12 +02:00
drm_print.c
drm_print: add _ddebug descriptor to drm_*dbg prototypes
2022-09-24 15:02:02 +02:00
drm_privacy_screen_x86.c
…
drm_privacy_screen.c
…
drm_probe_helper.c
drm/probe-helper: Cancel previous job before starting new one
2023-05-11 23:03:07 +09:00
drm_property.c
…
drm_rect.c
…
drm_scatter.c
…
drm_self_refresh_helper.c
…
drm_simple_kms_helper.c
drm/atomic-helper: Remove _HELPER_ infix from DRM_PLANE_HELPER_NO_SCALING
2022-07-26 18:42:00 +02:00
drm_syncobj.c
drm/syncobj: add missing error return code in drm_syncobj_transfer_to_timeline()
2022-06-13 08:54:16 +02:00
drm_sysfs.c
…
drm_trace_points.c
…
drm_trace.h
…
drm_vblank_work.c
…
drm_vblank.c
…
drm_vm.c
LoongArch: Add writecombine support for drm
2022-06-03 20:09:27 +08:00
drm_vma_manager.c
drm/drm_vma_manager: Add drm_vma_node_allow_once()
2023-02-01 08:34:42 +01:00
drm_writeback.c
drm: Drop drm_framebuffer.h from drm_crtc.h
2022-06-20 23:53:55 +03:00
Kconfig
drm: Disable dynamic debug as broken
2023-02-22 12:59:46 +01:00
Makefile
Driver core changes for 6.1-rc1
2022-10-07 17:04:10 -07:00