From: Greg Kroah-Hartman Date: Fri, 27 Jan 2017 08:49:22 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.4.46~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=da2005a997a6d207e2c7ca90392d3513da5695b3;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: drm-vc4-fix-a-bounds-check.patch drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch drm-vc4-fix-memory-leak-of-the-crtc-state.patch drm-vc4-return-einval-on-the-overflow-checks-failing.patch revert-drm-radeon-always-apply-pci-shutdown-callbacks.patch --- diff --git a/queue-4.9/drm-vc4-fix-a-bounds-check.patch b/queue-4.9/drm-vc4-fix-a-bounds-check.patch new file mode 100644 index 00000000000..90fb50a1a83 --- /dev/null +++ b/queue-4.9/drm-vc4-fix-a-bounds-check.patch @@ -0,0 +1,32 @@ +From 21ccc32496b2f63228f5232b3ac0e426e8fb3c31 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 13 Jan 2017 10:49:00 +0300 +Subject: drm/vc4: fix a bounds check + +From: Dan Carpenter + +commit 21ccc32496b2f63228f5232b3ac0e426e8fb3c31 upstream. + +We accidentally return success even if vc4_full_res_bounds_check() fails. + +Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.") +Signed-off-by: Dan Carpenter +Reviewed-by: Eric Engestrom +Reviewed-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vc4/vc4_render_cl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vc4/vc4_render_cl.c ++++ b/drivers/gpu/drm/vc4/vc4_render_cl.c +@@ -461,7 +461,7 @@ static int vc4_rcl_surface_setup(struct + } + + ret = vc4_full_res_bounds_check(exec, *obj, surf); +- if (!ret) ++ if (ret) + return ret; + + return 0; diff --git a/queue-4.9/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch b/queue-4.9/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch new file mode 100644 index 00000000000..b2a32e7fe6e --- /dev/null +++ b/queue-4.9/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch @@ -0,0 +1,41 @@ +From 0f2ff82e11c86c05d051cae32b58226392d33bbf Mon Sep 17 00:00:00 2001 +From: Eric Anholt +Date: Tue, 17 Jan 2017 21:42:53 +1100 +Subject: drm/vc4: Fix an integer overflow in temporary allocation layout. + +From: Eric Anholt + +commit 0f2ff82e11c86c05d051cae32b58226392d33bbf upstream. + +We copy the unvalidated ioctl arguments from the user into kernel +temporary memory to run the validation from, to avoid a race where the +user updates the unvalidate contents in between validating them and +copying them into the validated BO. + +However, in setting up the layout of the kernel side, we failed to +check one of the additions (the roundup() for shader_rec_offset) +against integer overflow, allowing a nearly MAX_UINT value of +bin_cl_size to cause us to under-allocate the temporary space that we +then copy_from_user into. + +Reported-by: Murray McAllister +Signed-off-by: Eric Anholt +Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vc4/vc4_gem.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vc4/vc4_gem.c ++++ b/drivers/gpu/drm/vc4/vc4_gem.c +@@ -594,7 +594,8 @@ vc4_get_bcl(struct drm_device *dev, stru + args->shader_rec_count); + struct vc4_bo *bo; + +- if (uniforms_offset < shader_rec_offset || ++ if (shader_rec_offset < args->bin_cl_size || ++ uniforms_offset < shader_rec_offset || + exec_size < uniforms_offset || + args->shader_rec_count >= (UINT_MAX / + sizeof(struct vc4_shader_state)) || diff --git a/queue-4.9/drm-vc4-fix-memory-leak-of-the-crtc-state.patch b/queue-4.9/drm-vc4-fix-memory-leak-of-the-crtc-state.patch new file mode 100644 index 00000000000..69638908a9f --- /dev/null +++ b/queue-4.9/drm-vc4-fix-memory-leak-of-the-crtc-state.patch @@ -0,0 +1,31 @@ +From 7622b25543665567d8830a63210385b7d705924b Mon Sep 17 00:00:00 2001 +From: Eric Anholt +Date: Mon, 10 Oct 2016 09:44:06 -0700 +Subject: drm/vc4: Fix memory leak of the CRTC state. + +From: Eric Anholt + +commit 7622b25543665567d8830a63210385b7d705924b upstream. + +The underscores variant frees the pointers inside, while the +no-underscores variant calls underscores and then frees the struct. + +Signed-off-by: Eric Anholt +Fixes: d8dbf44f13b9 ("drm/vc4: Make the CRTCs cooperate on allocating display lists.") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vc4/vc4_crtc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vc4/vc4_crtc.c ++++ b/drivers/gpu/drm/vc4/vc4_crtc.c +@@ -832,7 +832,7 @@ static void vc4_crtc_destroy_state(struc + + } + +- __drm_atomic_helper_crtc_destroy_state(state); ++ drm_atomic_helper_crtc_destroy_state(crtc, state); + } + + static const struct drm_crtc_funcs vc4_crtc_funcs = { diff --git a/queue-4.9/drm-vc4-return-einval-on-the-overflow-checks-failing.patch b/queue-4.9/drm-vc4-return-einval-on-the-overflow-checks-failing.patch new file mode 100644 index 00000000000..80de83d878b --- /dev/null +++ b/queue-4.9/drm-vc4-return-einval-on-the-overflow-checks-failing.patch @@ -0,0 +1,32 @@ +From 6b8ac63847bc2f958dd93c09edc941a0118992d9 Mon Sep 17 00:00:00 2001 +From: Eric Anholt +Date: Tue, 17 Jan 2017 21:58:06 +1100 +Subject: drm/vc4: Return -EINVAL on the overflow checks failing. + +From: Eric Anholt + +commit 6b8ac63847bc2f958dd93c09edc941a0118992d9 upstream. + +By failing to set the errno, we'd continue on to trying to set up the +RCL, and then oops on trying to dereference the tile_bo that binning +validation should have set up. + +Reported-by: Ingo Molnar +Signed-off-by: Eric Anholt +Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vc4/vc4_gem.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/vc4/vc4_gem.c ++++ b/drivers/gpu/drm/vc4/vc4_gem.c +@@ -601,6 +601,7 @@ vc4_get_bcl(struct drm_device *dev, stru + sizeof(struct vc4_shader_state)) || + temp_size < exec_size) { + DRM_ERROR("overflow in exec arguments\n"); ++ ret = -EINVAL; + goto fail; + } + diff --git a/queue-4.9/revert-drm-radeon-always-apply-pci-shutdown-callbacks.patch b/queue-4.9/revert-drm-radeon-always-apply-pci-shutdown-callbacks.patch new file mode 100644 index 00000000000..34abd2dae27 --- /dev/null +++ b/queue-4.9/revert-drm-radeon-always-apply-pci-shutdown-callbacks.patch @@ -0,0 +1,41 @@ +From b9b487e494712c8e5905b724e12f5ef17e9ae6f9 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 25 Jan 2017 12:00:29 -0500 +Subject: Revert "drm/radeon: always apply pci shutdown callbacks" + +From: Alex Deucher + +commit b9b487e494712c8e5905b724e12f5ef17e9ae6f9 upstream. + +This seems to break reboot on some evergreen systems. + +bugs: +https://bugs.freedesktop.org/show_bug.cgi?id=99524 +https://bugzilla.kernel.org/show_bug.cgi?id=192271 + +This reverts commit a481daa88fd4d6b54f25348972bba10b5f6a84d0. + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_drv.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_drv.c ++++ b/drivers/gpu/drm/radeon/radeon_drv.c +@@ -366,11 +366,10 @@ static void + radeon_pci_shutdown(struct pci_dev *pdev) + { + /* if we are running in a VM, make sure the device +- * torn down properly on reboot/shutdown. +- * unfortunately we can't detect certain +- * hypervisors so just do this all the time. ++ * torn down properly on reboot/shutdown + */ +- radeon_pci_remove(pdev); ++ if (radeon_device_is_virtual()) ++ radeon_pci_remove(pdev); + } + + static int radeon_pmops_suspend(struct device *dev) diff --git a/queue-4.9/series b/queue-4.9/series index 0067f8ff38e..54ccd913f2d 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -3,3 +3,8 @@ tile-ptrace-preserve-previous-registers-for-short-regset-write.patch drm-schedule-the-output_poll_work-with-1s-delay-if-we-have-delayed-event.patch drm-fix-broken-vt-switch-with-video-1366x768-option.patch drm-i915-ignore-bogus-plane-coordinates-on-skl-when-the-plane-is-not-visible.patch +drm-vc4-fix-memory-leak-of-the-crtc-state.patch +drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch +drm-vc4-return-einval-on-the-overflow-checks-failing.patch +drm-vc4-fix-a-bounds-check.patch +revert-drm-radeon-always-apply-pci-shutdown-callbacks.patch