4.9-stable patches

added patches:
	drm-vc4-fix-a-bounds-check.patch
	drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch
	drm-vc4-fix-memory-leak-of-the-crtc-state.patch
	drm-vc4-return-einval-on-the-overflow-checks-failing.patch
	revert-drm-radeon-always-apply-pci-shutdown-callbacks.patch

diff --git a/queue-4.9/drm-vc4-fix-a-bounds-check.patch b/queue-4.9/drm-vc4-fix-a-bounds-check.patch
new file mode 100644 (file)
index 0000000..90fb50a
--- /dev/null
+++ b/queue-4.9/drm-vc4-fix-a-bounds-check.patch
@@ -0,0 +1,32 @@
+From 21ccc32496b2f63228f5232b3ac0e426e8fb3c31 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 13 Jan 2017 10:49:00 +0300
+Subject: drm/vc4: fix a bounds check
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 21ccc32496b2f63228f5232b3ac0e426e8fb3c31 upstream.
+
+We accidentally return success even if vc4_full_res_bounds_check() fails.
+
+Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Eric Engestrom <eric@engestrom.ch>
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vc4/vc4_render_cl.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_render_cl.c
++++ b/drivers/gpu/drm/vc4/vc4_render_cl.c
+@@ -461,7 +461,7 @@ static int vc4_rcl_surface_setup(struct
+               }
+ 
+               ret = vc4_full_res_bounds_check(exec, *obj, surf);
+-              if (!ret)
++              if (ret)
+                       return ret;
+ 
+               return 0;

diff --git a/queue-4.9/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch b/queue-4.9/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch
new file mode 100644 (file)
index 0000000..b2a32e7
--- /dev/null
+++ b/queue-4.9/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch
@@ -0,0 +1,41 @@
+From 0f2ff82e11c86c05d051cae32b58226392d33bbf Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Tue, 17 Jan 2017 21:42:53 +1100
+Subject: drm/vc4: Fix an integer overflow in temporary allocation layout.
+
+From: Eric Anholt <eric@anholt.net>
+
+commit 0f2ff82e11c86c05d051cae32b58226392d33bbf upstream.
+
+We copy the unvalidated ioctl arguments from the user into kernel
+temporary memory to run the validation from, to avoid a race where the
+user updates the unvalidate contents in between validating them and
+copying them into the validated BO.
+
+However, in setting up the layout of the kernel side, we failed to
+check one of the additions (the roundup() for shader_rec_offset)
+against integer overflow, allowing a nearly MAX_UINT value of
+bin_cl_size to cause us to under-allocate the temporary space that we
+then copy_from_user into.
+
+Reported-by: Murray McAllister <murray.mcallister@insomniasec.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vc4/vc4_gem.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_gem.c
++++ b/drivers/gpu/drm/vc4/vc4_gem.c
+@@ -594,7 +594,8 @@ vc4_get_bcl(struct drm_device *dev, stru
+                                         args->shader_rec_count);
+       struct vc4_bo *bo;
+ 
+-      if (uniforms_offset < shader_rec_offset ||
++      if (shader_rec_offset < args->bin_cl_size ||
++          uniforms_offset < shader_rec_offset ||
+           exec_size < uniforms_offset ||
+           args->shader_rec_count >= (UINT_MAX /
+                                         sizeof(struct vc4_shader_state)) ||

diff --git a/queue-4.9/drm-vc4-fix-memory-leak-of-the-crtc-state.patch b/queue-4.9/drm-vc4-fix-memory-leak-of-the-crtc-state.patch
new file mode 100644 (file)
index 0000000..6963890
--- /dev/null
+++ b/queue-4.9/drm-vc4-fix-memory-leak-of-the-crtc-state.patch
@@ -0,0 +1,31 @@
+From 7622b25543665567d8830a63210385b7d705924b Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Mon, 10 Oct 2016 09:44:06 -0700
+Subject: drm/vc4: Fix memory leak of the CRTC state.
+
+From: Eric Anholt <eric@anholt.net>
+
+commit 7622b25543665567d8830a63210385b7d705924b upstream.
+
+The underscores variant frees the pointers inside, while the
+no-underscores variant calls underscores and then frees the struct.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Fixes: d8dbf44f13b9 ("drm/vc4: Make the CRTCs cooperate on allocating display lists.")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -832,7 +832,7 @@ static void vc4_crtc_destroy_state(struc
+ 
+       }
+ 
+-      __drm_atomic_helper_crtc_destroy_state(state);
++      drm_atomic_helper_crtc_destroy_state(crtc, state);
+ }
+ 
+ static const struct drm_crtc_funcs vc4_crtc_funcs = {

diff --git a/queue-4.9/drm-vc4-return-einval-on-the-overflow-checks-failing.patch b/queue-4.9/drm-vc4-return-einval-on-the-overflow-checks-failing.patch
new file mode 100644 (file)
index 0000000..80de83d
--- /dev/null
+++ b/queue-4.9/drm-vc4-return-einval-on-the-overflow-checks-failing.patch
@@ -0,0 +1,32 @@
+From 6b8ac63847bc2f958dd93c09edc941a0118992d9 Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Tue, 17 Jan 2017 21:58:06 +1100
+Subject: drm/vc4: Return -EINVAL on the overflow checks failing.
+
+From: Eric Anholt <eric@anholt.net>
+
+commit 6b8ac63847bc2f958dd93c09edc941a0118992d9 upstream.
+
+By failing to set the errno, we'd continue on to trying to set up the
+RCL, and then oops on trying to dereference the tile_bo that binning
+validation should have set up.
+
+Reported-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vc4/vc4_gem.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_gem.c
++++ b/drivers/gpu/drm/vc4/vc4_gem.c
+@@ -601,6 +601,7 @@ vc4_get_bcl(struct drm_device *dev, stru
+                                         sizeof(struct vc4_shader_state)) ||
+           temp_size < exec_size) {
+               DRM_ERROR("overflow in exec arguments\n");
++              ret = -EINVAL;
+               goto fail;
+       }
+ 

diff --git a/queue-4.9/revert-drm-radeon-always-apply-pci-shutdown-callbacks.patch b/queue-4.9/revert-drm-radeon-always-apply-pci-shutdown-callbacks.patch
new file mode 100644 (file)
index 0000000..34abd2d
--- /dev/null
+++ b/queue-4.9/revert-drm-radeon-always-apply-pci-shutdown-callbacks.patch
@@ -0,0 +1,41 @@
+From b9b487e494712c8e5905b724e12f5ef17e9ae6f9 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 25 Jan 2017 12:00:29 -0500
+Subject: Revert "drm/radeon: always apply pci shutdown callbacks"
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit b9b487e494712c8e5905b724e12f5ef17e9ae6f9 upstream.
+
+This seems to break reboot on some evergreen systems.
+
+bugs:
+https://bugs.freedesktop.org/show_bug.cgi?id=99524
+https://bugzilla.kernel.org/show_bug.cgi?id=192271
+
+This reverts commit a481daa88fd4d6b54f25348972bba10b5f6a84d0.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_drv.c |    7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_drv.c
++++ b/drivers/gpu/drm/radeon/radeon_drv.c
+@@ -366,11 +366,10 @@ static void
+ radeon_pci_shutdown(struct pci_dev *pdev)
+ {
+       /* if we are running in a VM, make sure the device
+-       * torn down properly on reboot/shutdown.
+-       * unfortunately we can't detect certain
+-       * hypervisors so just do this all the time.
++       * torn down properly on reboot/shutdown
+        */
+-      radeon_pci_remove(pdev);
++      if (radeon_device_is_virtual())
++              radeon_pci_remove(pdev);
+ }
+ 
+ static int radeon_pmops_suspend(struct device *dev)

diff --git a/queue-4.9/series b/queue-4.9/series
index 0067f8ff38eff1636dc4d1ac52e090ccf0288d5e..54ccd913f2dd287118b8843a759822d58c160fb9 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -3,3 +3,8 @@ tile-ptrace-preserve-previous-registers-for-short-regset-write.patch
 drm-schedule-the-output_poll_work-with-1s-delay-if-we-have-delayed-event.patch
 drm-fix-broken-vt-switch-with-video-1366x768-option.patch
 drm-i915-ignore-bogus-plane-coordinates-on-skl-when-the-plane-is-not-visible.patch
+drm-vc4-fix-memory-leak-of-the-crtc-state.patch
+drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch
+drm-vc4-return-einval-on-the-overflow-checks-failing.patch
+drm-vc4-fix-a-bounds-check.patch
+revert-drm-radeon-always-apply-pci-shutdown-callbacks.patch