4.16-stable patches

added patches:
	drm-vmwgfx-fix-host-logging-guestinfo-reading-error-paths.patch
	drm-vmwgfx-use-kasprintf.patch

diff --git a/queue-4.16/drm-vmwgfx-fix-host-logging-guestinfo-reading-error-paths.patch b/queue-4.16/drm-vmwgfx-fix-host-logging-guestinfo-reading-error-paths.patch
new file mode 100644 (file)
index 0000000..3191312
--- /dev/null
+++ b/queue-4.16/drm-vmwgfx-fix-host-logging-guestinfo-reading-error-paths.patch
@@ -0,0 +1,104 @@
+From f37230c0ad481091bc136788ff8b37dc86300c6d Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Wed, 23 May 2018 16:13:20 +0200
+Subject: drm/vmwgfx: Fix host logging / guestinfo reading error paths
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit f37230c0ad481091bc136788ff8b37dc86300c6d upstream.
+
+The error paths were leaking opened channels.
+Fix by using dedicated error paths.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Brian Paul <brianp@vmware.com>
+Reviewed-by: Sinclair Yeh <syeh@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_msg.c |   48 +++++++++++++++++++++++-------------
+ 1 file changed, 31 insertions(+), 17 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+@@ -329,8 +329,6 @@ int vmw_host_get_guestinfo(const char *g
+       struct rpc_channel channel;
+       char *msg, *reply = NULL;
+       size_t reply_len = 0;
+-      int ret = 0;
+-
+ 
+       if (!vmw_msg_enabled)
+               return -ENODEV;
+@@ -344,15 +342,14 @@ int vmw_host_get_guestinfo(const char *g
+               return -ENOMEM;
+       }
+ 
+-      if (vmw_open_channel(&channel, RPCI_PROTOCOL_NUM) ||
+-          vmw_send_msg(&channel, msg) ||
+-          vmw_recv_msg(&channel, (void *) &reply, &reply_len) ||
+-          vmw_close_channel(&channel)) {
+-              DRM_ERROR("Failed to get %s", guest_info_param);
++      if (vmw_open_channel(&channel, RPCI_PROTOCOL_NUM))
++              goto out_open;
+ 
+-              ret = -EINVAL;
+-      }
++      if (vmw_send_msg(&channel, msg) ||
++          vmw_recv_msg(&channel, (void *) &reply, &reply_len))
++              goto out_msg;
+ 
++      vmw_close_channel(&channel);
+       if (buffer && reply && reply_len > 0) {
+               /* Remove reply code, which are the first 2 characters of
+                * the reply
+@@ -369,7 +366,17 @@ int vmw_host_get_guestinfo(const char *g
+       kfree(reply);
+       kfree(msg);
+ 
+-      return ret;
++      return 0;
++
++out_msg:
++      vmw_close_channel(&channel);
++      kfree(reply);
++out_open:
++      *length = 0;
++      kfree(msg);
++      DRM_ERROR("Failed to get %s", guest_info_param);
++
++      return -EINVAL;
+ }
+ 
+ 
+@@ -400,15 +407,22 @@ int vmw_host_log(const char *log)
+               return -ENOMEM;
+       }
+ 
+-      if (vmw_open_channel(&channel, RPCI_PROTOCOL_NUM) ||
+-          vmw_send_msg(&channel, msg) ||
+-          vmw_close_channel(&channel)) {
+-              DRM_ERROR("Failed to send log\n");
++      if (vmw_open_channel(&channel, RPCI_PROTOCOL_NUM))
++              goto out_open;
+ 
+-              ret = -EINVAL;
+-      }
++      if (vmw_send_msg(&channel, msg))
++              goto out_msg;
++
++      vmw_close_channel(&channel);
++      kfree(msg);
++
++      return 0;
+ 
++out_msg:
++      vmw_close_channel(&channel);
++out_open:
+       kfree(msg);
++      DRM_ERROR("Failed to send log\n");
+ 
+-      return ret;
++      return -EINVAL;
+ }

diff --git a/queue-4.16/drm-vmwgfx-use-kasprintf.patch b/queue-4.16/drm-vmwgfx-use-kasprintf.patch
new file mode 100644 (file)
index 0000000..0be21d5
--- /dev/null
+++ b/queue-4.16/drm-vmwgfx-use-kasprintf.patch
@@ -0,0 +1,75 @@
+From 6073a09210e06f39adabd682c282b3ee14c3d33d Mon Sep 17 00:00:00 2001
+From: Himanshu Jha <himanshujha199640@gmail.com>
+Date: Thu, 22 Mar 2018 10:33:03 +0100
+Subject: drm/vmwgfx: Use kasprintf
+
+From: Himanshu Jha <himanshujha199640@gmail.com>
+
+commit 6073a09210e06f39adabd682c282b3ee14c3d33d upstream.
+
+Use kasprintf instead of combination of kmalloc and sprintf. Also,
+remove the local variables used for storing the string length as they
+are not required now.
+
+Signed-off-by: Himanshu Jha <himanshujha199640@gmail.com>
+Reviewed-by: Sinclair Yeh <syeh@vmware.com>
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_msg.c |   13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+@@ -328,7 +328,7 @@ int vmw_host_get_guestinfo(const char *g
+ {
+       struct rpc_channel channel;
+       char *msg, *reply = NULL;
+-      size_t msg_len, reply_len = 0;
++      size_t reply_len = 0;
+       int ret = 0;
+ 
+ 
+@@ -338,15 +338,12 @@ int vmw_host_get_guestinfo(const char *g
+       if (!guest_info_param || !length)
+               return -EINVAL;
+ 
+-      msg_len = strlen(guest_info_param) + strlen("info-get ") + 1;
+-      msg = kzalloc(msg_len, GFP_KERNEL);
++      msg = kasprintf(GFP_KERNEL, "info-get %s", guest_info_param);
+       if (!msg) {
+               DRM_ERROR("Cannot allocate memory to get %s", guest_info_param);
+               return -ENOMEM;
+       }
+ 
+-      sprintf(msg, "info-get %s", guest_info_param);
+-
+       if (vmw_open_channel(&channel, RPCI_PROTOCOL_NUM) ||
+           vmw_send_msg(&channel, msg) ||
+           vmw_recv_msg(&channel, (void *) &reply, &reply_len) ||
+@@ -388,7 +385,6 @@ int vmw_host_log(const char *log)
+ {
+       struct rpc_channel channel;
+       char *msg;
+-      int msg_len;
+       int ret = 0;
+ 
+ 
+@@ -398,15 +394,12 @@ int vmw_host_log(const char *log)
+       if (!log)
+               return ret;
+ 
+-      msg_len = strlen(log) + strlen("log ") + 1;
+-      msg = kzalloc(msg_len, GFP_KERNEL);
++      msg = kasprintf(GFP_KERNEL, "log %s", log);
+       if (!msg) {
+               DRM_ERROR("Cannot allocate memory for log message\n");
+               return -ENOMEM;
+       }
+ 
+-      sprintf(msg, "log %s", log);
+-
+       if (vmw_open_channel(&channel, RPCI_PROTOCOL_NUM) ||
+           vmw_send_msg(&channel, msg) ||
+           vmw_close_channel(&channel)) {

diff --git a/queue-4.16/series b/queue-4.16/series
index a8f185155dcf1e7251ad2f9ae036ca680bd65420..6e975e046b3e05eb0e0112563634f2006c8f1ed2 100644 (file)
--- a/queue-4.16/series
+++ b/queue-4.16/series
@@ -5,3 +5,5 @@ objtool-detect-rip-relative-switch-table-references-part-2.patch
 objtool-fix-noreturn-detection-for-recursive-sibling-calls.patch
 x86-mce-amd-carve-out-smca-get_block_address-code.patch
 x86-mce-amd-cache-smca-misc-block-addresses.patch
+drm-vmwgfx-use-kasprintf.patch
+drm-vmwgfx-fix-host-logging-guestinfo-reading-error-paths.patch