update queue-4.14/drm-qxl-qxl_release-use-after-free.patch queue-4.19/drm-qxl-qxl_rel...

diff --git a/queue-4.14/drm-qxl-qxl_release-use-after-free.patch b/queue-4.14/drm-qxl-qxl_release-use-after-free.patch
index b0e1e629e331ba4f2038c3de09a35d02ae464a18..4a245cd4fc1fdc5a8f137d47f91d984002eaed37 100644 (file)
--- a/queue-4.14/drm-qxl-qxl_release-use-after-free.patch
+++ b/queue-4.14/drm-qxl-qxl_release-use-after-free.patch
@@ -22,14 +22,16 @@ Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
 Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
 Link: http://patchwork.freedesktop.org/patch/msgid/fa17b338-66ae-f299-68fe-8d32419d9071@virtuozzo.com
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+[backported to v4.14-stable]
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 ---
  drivers/gpu/drm/qxl/qxl_cmd.c     |    5 ++---
  drivers/gpu/drm/qxl/qxl_display.c |    6 +++---
- drivers/gpu/drm/qxl/qxl_draw.c    |    2 +-
+ drivers/gpu/drm/qxl/qxl_draw.c    |    8 ++++----
  drivers/gpu/drm/qxl/qxl_ioctl.c   |    5 +----
- 4 files changed, 7 insertions(+), 11 deletions(-)
+ 4 files changed, 10 insertions(+), 14 deletions(-)
 
 --- a/drivers/gpu/drm/qxl/qxl_cmd.c
 +++ b/drivers/gpu/drm/qxl/qxl_cmd.c
@@ -88,6 +90,16 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  static int qxl_plane_prepare_fb(struct drm_plane *plane,
 --- a/drivers/gpu/drm/qxl/qxl_draw.c
 +++ b/drivers/gpu/drm/qxl/qxl_draw.c
+@@ -241,8 +241,8 @@ void qxl_draw_opaque_fb(const struct qxl
+               qxl_bo_physical_address(qdev, dimage->bo, 0);
+       qxl_release_unmap(qdev, release, &drawable->release_info);
+ 
+-      qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+       qxl_release_fence_buffer_objects(release);
++      qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+ 
+ out_free_palette:
+       if (palette_bo)
 @@ -382,8 +382,8 @@ void qxl_draw_dirty_fb(struct qxl_device
        }
        qxl_bo_kunmap(clips_bo);
@@ -98,6 +110,26 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  
  out_release_backoff:
        if (ret)
+@@ -433,8 +433,8 @@ void qxl_draw_copyarea(struct qxl_device
+       drawable->u.copy_bits.src_pos.y = sy;
+       qxl_release_unmap(qdev, release, &drawable->release_info);
+ 
+-      qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+       qxl_release_fence_buffer_objects(release);
++      qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+ 
+ out_free_release:
+       if (ret)
+@@ -477,8 +477,8 @@ void qxl_draw_fill(struct qxl_draw_fill
+ 
+       qxl_release_unmap(qdev, release, &drawable->release_info);
+ 
+-      qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+       qxl_release_fence_buffer_objects(release);
++      qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+ 
+ out_free_release:
+       if (ret)
 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c
 +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
 @@ -257,11 +257,8 @@ static int qxl_process_single_command(st

diff --git a/queue-4.19/drm-qxl-qxl_release-use-after-free.patch b/queue-4.19/drm-qxl-qxl_release-use-after-free.patch
index 629d2b1351eb8506785cb34989fbf28450402456..b9337923f12bd4522c3a101cb5eda076f704ae9e 100644 (file)
--- a/queue-4.19/drm-qxl-qxl_release-use-after-free.patch
+++ b/queue-4.19/drm-qxl-qxl_release-use-after-free.patch
@@ -22,14 +22,16 @@ Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
 Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
 Link: http://patchwork.freedesktop.org/patch/msgid/fa17b338-66ae-f299-68fe-8d32419d9071@virtuozzo.com
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+[backported to v.4.19 stable]
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 ---
  drivers/gpu/drm/qxl/qxl_cmd.c     |    5 ++---
  drivers/gpu/drm/qxl/qxl_display.c |    6 +++---
- drivers/gpu/drm/qxl/qxl_draw.c    |    2 +-
+ drivers/gpu/drm/qxl/qxl_draw.c    |    8 ++++----
  drivers/gpu/drm/qxl/qxl_ioctl.c   |    5 +----
- 4 files changed, 7 insertions(+), 11 deletions(-)
+ 4 files changed, 10 insertions(+), 14 deletions(-)
 
 --- a/drivers/gpu/drm/qxl/qxl_cmd.c
 +++ b/drivers/gpu/drm/qxl/qxl_cmd.c
@@ -88,6 +90,16 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  static int qxl_plane_prepare_fb(struct drm_plane *plane,
 --- a/drivers/gpu/drm/qxl/qxl_draw.c
 +++ b/drivers/gpu/drm/qxl/qxl_draw.c
+@@ -241,8 +241,8 @@ void qxl_draw_opaque_fb(const struct qxl
+               qxl_bo_physical_address(qdev, dimage->bo, 0);
+       qxl_release_unmap(qdev, release, &drawable->release_info);
+ 
+-      qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+       qxl_release_fence_buffer_objects(release);
++      qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+ 
+ out_free_palette:
+       if (palette_bo)
 @@ -382,8 +382,8 @@ void qxl_draw_dirty_fb(struct qxl_device
        }
        qxl_bo_kunmap(clips_bo);
@@ -98,6 +110,26 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  
  out_release_backoff:
        if (ret)
+@@ -433,8 +433,8 @@ void qxl_draw_copyarea(struct qxl_device
+       drawable->u.copy_bits.src_pos.y = sy;
+       qxl_release_unmap(qdev, release, &drawable->release_info);
+ 
+-      qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+       qxl_release_fence_buffer_objects(release);
++      qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+ 
+ out_free_release:
+       if (ret)
+@@ -477,8 +477,8 @@ void qxl_draw_fill(struct qxl_draw_fill
+ 
+       qxl_release_unmap(qdev, release, &drawable->release_info);
+ 
+-      qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+       qxl_release_fence_buffer_objects(release);
++      qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+ 
+ out_free_release:
+       if (ret)
 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c
 +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
 @@ -257,11 +257,8 @@ static int qxl_process_single_command(st