bybrooklyn/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-04-18 14:53:58 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'drm-misc-fixes-2025-10-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

Browse Source 
Short summary of fixes pull:

nouveau:
- Return errno code from TTM move helper

vmwgfx:
- Fix null-ptr access in cursor code
- Fix UAF in validation
- Use correct iterator in validation

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://lore.kernel.org/r/20251009120004.GA17570@linux.fritz.box
This commit is contained in:
Dave Airlie
2025-10-11 06:17:06 +10:00
parent e5f0a698b3 e4bea91958
commit 5ca5f00a16
3 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/gpu/drm/nouveau/nouveau_bo.c
View File

@@ -929,7 +929,7 @@ done:
nvif_vmm_put(vmm, &old_mem->vma[1]); nvif_vmm_put(vmm, &old_mem->vma[1]);
nvif_vmm_put(vmm, &old_mem->vma[0]); nvif_vmm_put(vmm, &old_mem->vma[0]);
} }
return 0; return ret;
} }
static int static int

17
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
View File

@@ -1497,6 +1497,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
SVGA3dCmdHeader *header) SVGA3dCmdHeader *header)
{ {
struct vmw_bo *vmw_bo = NULL; struct vmw_bo *vmw_bo = NULL;
struct vmw_resource *res;
struct vmw_surface *srf = NULL; struct vmw_surface *srf = NULL;
VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA); VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA);
int ret; int ret;
@@ -1532,18 +1533,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ? dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ?
VMW_RES_DIRTY_SET : 0; VMW_RES_DIRTY_SET : 0;
ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty,
dirty, user_surface_converter, user_surface_converter, &cmd->body.host.sid,
&cmd->body.host.sid, NULL); NULL);
if (unlikely(ret != 0)) { if (unlikely(ret != 0)) {
if (unlikely(ret != -ERESTARTSYS)) if (unlikely(ret != -ERESTARTSYS))
VMW_DEBUG_USER("could not find surface for DMA.\n"); VMW_DEBUG_USER("could not find surface for DMA.\n");
return ret; return ret;
} }
srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res); res = sw_context->res_cache[vmw_res_surface].res;
if (!res) {
VMW_DEBUG_USER("Invalid DMA surface.\n");
return -EINVAL;
}
vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header); srf = vmw_res_to_srf(res);
vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo,
header);
return 0; return 0;
} }

6
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
View File

@@ -308,8 +308,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,
hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key); hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key);
} }
node->res = vmw_resource_reference_unless_doomed(res); node->res = vmw_resource_reference_unless_doomed(res);
if (!node->res) if (!node->res) {
hash_del_rcu(&node->hash.head);
return -ESRCH; return -ESRCH;
}
node->first_usage = 1; node->first_usage = 1;
if (!res->dev_priv->has_mob) { if (!res->dev_priv->has_mob) {
@@ -636,7 +638,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx)
hash_del_rcu(&val->hash.head); hash_del_rcu(&val->hash.head);
list_for_each_entry(val, &ctx->resource_ctx_list, head) list_for_each_entry(val, &ctx->resource_ctx_list, head)
hash_del_rcu(&entry->hash.head); hash_del_rcu(&val->hash.head);
ctx->sw_context = NULL; ctx->sw_context = NULL;
} }