From: Greg Kroah-Hartman Date: Thu, 11 May 2017 12:46:58 +0000 (+0200) Subject: 4.10-stable patches X-Git-Tag: v4.4.68~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=30541806b5e8bf0f7970240e391a276c8642cc21;p=thirdparty%2Fkernel%2Fstable-queue.git 4.10-stable patches added patches: drm-hisilicon-hibmc-fix-wrong-pointer-passed-to-ptr_err.patch drm-mxsfb-drm_dev_alloc-returns-error-pointers.patch drm-ttm-fix-use-after-free-races-in-vm-fault-handling.patch --- diff --git a/queue-4.10/drm-hisilicon-hibmc-fix-wrong-pointer-passed-to-ptr_err.patch b/queue-4.10/drm-hisilicon-hibmc-fix-wrong-pointer-passed-to-ptr_err.patch new file mode 100644 index 00000000000..55e9fd4ce2e --- /dev/null +++ b/queue-4.10/drm-hisilicon-hibmc-fix-wrong-pointer-passed-to-ptr_err.patch @@ -0,0 +1,34 @@ +From bdf6f135973acb409b3ec5a6214fb597670a0bc0 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Thu, 12 Jan 2017 15:19:21 +0000 +Subject: drm/hisilicon/hibmc: Fix wrong pointer passed to PTR_ERR() + +From: Wei Yongjun + +commit bdf6f135973acb409b3ec5a6214fb597670a0bc0 upstream. + +PTR_ERR should access the value just tested by IS_ERR, otherwise +the wrong error code will be returned. + +Fixes: d1667b86795a ("drm/hisilicon/hibmc: Add support for frame buffer") +Signed-off-by: Wei Yongjun +Reviewed-by: Gustavo Padovan +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/20170112151921.16538-1-weiyj.lk@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c ++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c +@@ -121,7 +121,7 @@ static int hibmc_drm_fb_create(struct dr + + hi_fbdev->fb = hibmc_framebuffer_init(priv->dev, &mode_cmd, gobj); + if (IS_ERR(hi_fbdev->fb)) { +- ret = PTR_ERR(info); ++ ret = PTR_ERR(hi_fbdev->fb); + DRM_ERROR("failed to initialize framebuffer: %d\n", ret); + goto out_release_fbi; + } diff --git a/queue-4.10/drm-mxsfb-drm_dev_alloc-returns-error-pointers.patch b/queue-4.10/drm-mxsfb-drm_dev_alloc-returns-error-pointers.patch new file mode 100644 index 00000000000..1650d889e84 --- /dev/null +++ b/queue-4.10/drm-mxsfb-drm_dev_alloc-returns-error-pointers.patch @@ -0,0 +1,35 @@ +From e89e50ac35d9126907a436dabe70f9a8311b9981 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 13 Dec 2016 15:23:32 +0300 +Subject: drm: mxsfb: drm_dev_alloc() returns error pointers + +From: Dan Carpenter + +commit e89e50ac35d9126907a436dabe70f9a8311b9981 upstream. + +We should be checking for IS_ERR() instead of NULL because +drm_dev_alloc() returns error pointers. + +Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller") +Signed-off-by: Dan Carpenter +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/20161213122332.GA7519@elgon.mountain +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/mxsfb/mxsfb_drv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c ++++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c +@@ -395,8 +395,8 @@ static int mxsfb_probe(struct platform_d + pdev->id_entry = of_id->data; + + drm = drm_dev_alloc(&mxsfb_driver, &pdev->dev); +- if (!drm) +- return -ENOMEM; ++ if (IS_ERR(drm)) ++ return PTR_ERR(drm); + + ret = mxsfb_load(drm, 0); + if (ret) diff --git a/queue-4.10/drm-ttm-fix-use-after-free-races-in-vm-fault-handling.patch b/queue-4.10/drm-ttm-fix-use-after-free-races-in-vm-fault-handling.patch new file mode 100644 index 00000000000..a4324ef2fd8 --- /dev/null +++ b/queue-4.10/drm-ttm-fix-use-after-free-races-in-vm-fault-handling.patch @@ -0,0 +1,69 @@ +From 3089c1df10e2931b1d72d2ffa7d86431084c86b3 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Nicolai=20H=C3=A4hnle?= +Date: Sat, 18 Feb 2017 22:59:56 +0100 +Subject: drm/ttm: fix use-after-free races in vm fault handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nicolai Hähnle + +commit 3089c1df10e2931b1d72d2ffa7d86431084c86b3 upstream. + +The vm fault handler relies on the fact that the VMA owns a reference +to the BO. However, once mmap_sem is released, other tasks are free to +destroy the VMA, which can lead to the BO being freed. Fix two code +paths where that can happen, both related to vm fault retries. + +Found via a lock debugging warning which flagged &bo->wu_mutex as +locked while being destroyed. + +Fixes: cbe12e74ee4e ("drm/ttm: Allow vm fault retries") +Signed-off-by: Nicolai Hähnle +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/ttm/ttm_bo_vm.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c ++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c +@@ -66,8 +66,11 @@ static int ttm_bo_vm_fault_idle(struct t + if (vmf->flags & FAULT_FLAG_RETRY_NOWAIT) + goto out_unlock; + ++ ttm_bo_reference(bo); + up_read(&vma->vm_mm->mmap_sem); + (void) dma_fence_wait(bo->moving, true); ++ ttm_bo_unreserve(bo); ++ ttm_bo_unref(&bo); + goto out_unlock; + } + +@@ -120,8 +123,10 @@ static int ttm_bo_vm_fault(struct vm_are + + if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) { + if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) { ++ ttm_bo_reference(bo); + up_read(&vma->vm_mm->mmap_sem); + (void) ttm_bo_wait_unreserved(bo); ++ ttm_bo_unref(&bo); + } + + return VM_FAULT_RETRY; +@@ -166,6 +171,13 @@ static int ttm_bo_vm_fault(struct vm_are + ret = ttm_bo_vm_fault_idle(bo, vma, vmf); + if (unlikely(ret != 0)) { + retval = ret; ++ ++ if (retval == VM_FAULT_RETRY && ++ !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) { ++ /* The BO has already been unreserved. */ ++ return retval; ++ } ++ + goto out_unlock; + } + diff --git a/queue-4.10/series b/queue-4.10/series index 5dd46cf156d..c2608566044 100644 --- a/queue-4.10/series +++ b/queue-4.10/series @@ -123,3 +123,6 @@ net-mdio-mux-bcm-iproc-call-mdiobus_free-in-error-path.patch openvswitch-set-internal-device-max-mtu-to-eth_max_mtu.patch f2fs-sanity-check-segment-count.patch xen-revert-commits-da72ff5bfcb0-and-72a9b186292d.patch +drm-hisilicon-hibmc-fix-wrong-pointer-passed-to-ptr_err.patch +drm-mxsfb-drm_dev_alloc-returns-error-pointers.patch +drm-ttm-fix-use-after-free-races-in-vm-fault-handling.patch