+++ /dev/null
-From c4a32b266da7bb702e60381ca0c35eaddbc89a6c Mon Sep 17 00:00:00 2001
-From: Yu Zhao <yuzhao@google.com>
-Date: Mon, 7 Jan 2019 15:51:15 -0700
-Subject: drm/amdgpu: validate user GEM object size
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Yu Zhao <yuzhao@google.com>
-
-commit c4a32b266da7bb702e60381ca0c35eaddbc89a6c upstream.
-
-When creating frame buffer, userspace may request to attach to a
-previously allocated GEM object that is smaller than what GPU
-requires. Validation must be done to prevent out-of-bound DMA,
-otherwise it could be exploited to reveal sensitive data.
-
-This fix is not done in a common code path because individual
-driver might have different requirement.
-
-Cc: stable@vger.kernel.org # v4.2+
-Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
-Signed-off-by: Yu Zhao <yuzhao@google.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-@@ -526,6 +526,7 @@ amdgpu_user_framebuffer_create(struct dr
- struct drm_gem_object *obj;
- struct amdgpu_framebuffer *amdgpu_fb;
- int ret;
-+ int height;
- struct amdgpu_device *adev = dev->dev_private;
- int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
- int pitch = mode_cmd->pitches[0] / cpp;
-@@ -550,6 +551,13 @@ amdgpu_user_framebuffer_create(struct dr
- return ERR_PTR(-EINVAL);
- }
-
-+ height = ALIGN(mode_cmd->height, 8);
-+ if (obj->size < pitch * height) {
-+ DRM_DEBUG_KMS("Invalid GEM size: expecting >= %d but got %zu\n",
-+ pitch * height, obj->size);
-+ return ERR_PTR(-EINVAL);
-+ }
-+
- amdgpu_fb = kzalloc(sizeof(*amdgpu_fb), GFP_KERNEL);
- if (amdgpu_fb == NULL) {
- drm_gem_object_put_unlocked(obj);
+++ /dev/null
-From 89f23b6efef554766177bf51aa754bce14c3e7da Mon Sep 17 00:00:00 2001
-From: Yu Zhao <yuzhao@google.com>
-Date: Mon, 7 Jan 2019 15:51:14 -0700
-Subject: drm/amdgpu: validate user pitch alignment
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Yu Zhao <yuzhao@google.com>
-
-commit 89f23b6efef554766177bf51aa754bce14c3e7da upstream.
-
-Userspace may request pitch alignment that is not supported by GPU.
-Some requests 32, but GPU ignores it and uses default 64 when cpp is
-4. If GEM object is allocated based on the smaller alignment, GPU
-DMA will go out of bound.
-
-Cc: stable@vger.kernel.org # v4.2+
-Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
-Signed-off-by: Yu Zhao <yuzhao@google.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-@@ -526,6 +526,16 @@ amdgpu_user_framebuffer_create(struct dr
- struct drm_gem_object *obj;
- struct amdgpu_framebuffer *amdgpu_fb;
- int ret;
-+ struct amdgpu_device *adev = dev->dev_private;
-+ int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
-+ int pitch = mode_cmd->pitches[0] / cpp;
-+
-+ pitch = amdgpu_align_pitch(adev, pitch, cpp, false);
-+ if (mode_cmd->pitches[0] != pitch) {
-+ DRM_DEBUG_KMS("Invalid pitch: expecting %d but got %d\n",
-+ pitch, mode_cmd->pitches[0]);
-+ return ERR_PTR(-EINVAL);
-+ }
-
- obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[0]);
- if (obj == NULL) {
acpi-pmic-xpower-fix-ts-pin-current-source-handling.patch
i2c-dev-prevent-adapter-retries-and-timeout-being-set-as-minus-value.patch
drm-fb-helper-partially-bring-back-workaround-for-bugs-of-sdl-1.2.patch
-drm-amdgpu-validate-user-pitch-alignment.patch
-drm-amdgpu-validate-user-gem-object-size.patch
rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch
ext4-make-sure-enough-credits-are-reserved-for-dioread_nolock-writes.patch
ext4-fix-a-potential-fiemap-page-fault-deadlock-w-inline_data.patch
+++ /dev/null
-From c4a32b266da7bb702e60381ca0c35eaddbc89a6c Mon Sep 17 00:00:00 2001
-From: Yu Zhao <yuzhao@google.com>
-Date: Mon, 7 Jan 2019 15:51:15 -0700
-Subject: drm/amdgpu: validate user GEM object size
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Yu Zhao <yuzhao@google.com>
-
-commit c4a32b266da7bb702e60381ca0c35eaddbc89a6c upstream.
-
-When creating frame buffer, userspace may request to attach to a
-previously allocated GEM object that is smaller than what GPU
-requires. Validation must be done to prevent out-of-bound DMA,
-otherwise it could be exploited to reveal sensitive data.
-
-This fix is not done in a common code path because individual
-driver might have different requirement.
-
-Cc: stable@vger.kernel.org # v4.2+
-Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
-Signed-off-by: Yu Zhao <yuzhao@google.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-@@ -527,6 +527,7 @@ amdgpu_display_user_framebuffer_create(s
- struct drm_gem_object *obj;
- struct amdgpu_framebuffer *amdgpu_fb;
- int ret;
-+ int height;
- struct amdgpu_device *adev = dev->dev_private;
- int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
- int pitch = mode_cmd->pitches[0] / cpp;
-@@ -551,6 +552,13 @@ amdgpu_display_user_framebuffer_create(s
- return ERR_PTR(-EINVAL);
- }
-
-+ height = ALIGN(mode_cmd->height, 8);
-+ if (obj->size < pitch * height) {
-+ DRM_DEBUG_KMS("Invalid GEM size: expecting >= %d but got %zu\n",
-+ pitch * height, obj->size);
-+ return ERR_PTR(-EINVAL);
-+ }
-+
- amdgpu_fb = kzalloc(sizeof(*amdgpu_fb), GFP_KERNEL);
- if (amdgpu_fb == NULL) {
- drm_gem_object_put_unlocked(obj);
+++ /dev/null
-From 89f23b6efef554766177bf51aa754bce14c3e7da Mon Sep 17 00:00:00 2001
-From: Yu Zhao <yuzhao@google.com>
-Date: Mon, 7 Jan 2019 15:51:14 -0700
-Subject: drm/amdgpu: validate user pitch alignment
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Yu Zhao <yuzhao@google.com>
-
-commit 89f23b6efef554766177bf51aa754bce14c3e7da upstream.
-
-Userspace may request pitch alignment that is not supported by GPU.
-Some requests 32, but GPU ignores it and uses default 64 when cpp is
-4. If GEM object is allocated based on the smaller alignment, GPU
-DMA will go out of bound.
-
-Cc: stable@vger.kernel.org # v4.2+
-Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
-Signed-off-by: Yu Zhao <yuzhao@google.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-@@ -527,6 +527,16 @@ amdgpu_display_user_framebuffer_create(s
- struct drm_gem_object *obj;
- struct amdgpu_framebuffer *amdgpu_fb;
- int ret;
-+ struct amdgpu_device *adev = dev->dev_private;
-+ int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
-+ int pitch = mode_cmd->pitches[0] / cpp;
-+
-+ pitch = amdgpu_align_pitch(adev, pitch, cpp, false);
-+ if (mode_cmd->pitches[0] != pitch) {
-+ DRM_DEBUG_KMS("Invalid pitch: expecting %d but got %d\n",
-+ pitch, mode_cmd->pitches[0]);
-+ return ERR_PTR(-EINVAL);
-+ }
-
- obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[0]);
- if (obj == NULL) {
drm-fb_helper-allow-leaking-fbdev-smem_start.patch
drm-fb-helper-partially-bring-back-workaround-for-bugs-of-sdl-1.2.patch
drm-i915-unwind-failure-on-pinning-the-gen7-ppgtt.patch
-drm-amdgpu-validate-user-pitch-alignment.patch
-drm-amdgpu-validate-user-gem-object-size.patch
drm-amdgpu-don-t-ignore-rc-from-drm_dp_mst_topology_mgr_resume.patch
drm-amdgpu-don-t-fail-resume-process-if-resuming-atomic-state-fails.patch
rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch
+++ /dev/null
-From c4a32b266da7bb702e60381ca0c35eaddbc89a6c Mon Sep 17 00:00:00 2001
-From: Yu Zhao <yuzhao@google.com>
-Date: Mon, 7 Jan 2019 15:51:15 -0700
-Subject: drm/amdgpu: validate user GEM object size
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Yu Zhao <yuzhao@google.com>
-
-commit c4a32b266da7bb702e60381ca0c35eaddbc89a6c upstream.
-
-When creating frame buffer, userspace may request to attach to a
-previously allocated GEM object that is smaller than what GPU
-requires. Validation must be done to prevent out-of-bound DMA,
-otherwise it could be exploited to reveal sensitive data.
-
-This fix is not done in a common code path because individual
-driver might have different requirement.
-
-Cc: stable@vger.kernel.org # v4.2+
-Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
-Signed-off-by: Yu Zhao <yuzhao@google.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-@@ -527,6 +527,7 @@ amdgpu_display_user_framebuffer_create(s
- struct drm_gem_object *obj;
- struct amdgpu_framebuffer *amdgpu_fb;
- int ret;
-+ int height;
- struct amdgpu_device *adev = dev->dev_private;
- int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
- int pitch = mode_cmd->pitches[0] / cpp;
-@@ -551,6 +552,13 @@ amdgpu_display_user_framebuffer_create(s
- return ERR_PTR(-EINVAL);
- }
-
-+ height = ALIGN(mode_cmd->height, 8);
-+ if (obj->size < pitch * height) {
-+ DRM_DEBUG_KMS("Invalid GEM size: expecting >= %d but got %zu\n",
-+ pitch * height, obj->size);
-+ return ERR_PTR(-EINVAL);
-+ }
-+
- amdgpu_fb = kzalloc(sizeof(*amdgpu_fb), GFP_KERNEL);
- if (amdgpu_fb == NULL) {
- drm_gem_object_put_unlocked(obj);
+++ /dev/null
-From 89f23b6efef554766177bf51aa754bce14c3e7da Mon Sep 17 00:00:00 2001
-From: Yu Zhao <yuzhao@google.com>
-Date: Mon, 7 Jan 2019 15:51:14 -0700
-Subject: drm/amdgpu: validate user pitch alignment
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Yu Zhao <yuzhao@google.com>
-
-commit 89f23b6efef554766177bf51aa754bce14c3e7da upstream.
-
-Userspace may request pitch alignment that is not supported by GPU.
-Some requests 32, but GPU ignores it and uses default 64 when cpp is
-4. If GEM object is allocated based on the smaller alignment, GPU
-DMA will go out of bound.
-
-Cc: stable@vger.kernel.org # v4.2+
-Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
-Signed-off-by: Yu Zhao <yuzhao@google.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-@@ -527,6 +527,16 @@ amdgpu_display_user_framebuffer_create(s
- struct drm_gem_object *obj;
- struct amdgpu_framebuffer *amdgpu_fb;
- int ret;
-+ struct amdgpu_device *adev = dev->dev_private;
-+ int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
-+ int pitch = mode_cmd->pitches[0] / cpp;
-+
-+ pitch = amdgpu_align_pitch(adev, pitch, cpp, false);
-+ if (mode_cmd->pitches[0] != pitch) {
-+ DRM_DEBUG_KMS("Invalid pitch: expecting %d but got %d\n",
-+ pitch, mode_cmd->pitches[0]);
-+ return ERR_PTR(-EINVAL);
-+ }
-
- obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[0]);
- if (obj == NULL) {
drm-amd-display-fix-mst-dp_blank-reg_wait-timeout.patch
drm-fb-helper-partially-bring-back-workaround-for-bugs-of-sdl-1.2.patch
drm-i915-unwind-failure-on-pinning-the-gen7-ppgtt.patch
-drm-amdgpu-validate-user-pitch-alignment.patch
-drm-amdgpu-validate-user-gem-object-size.patch
drm-amdgpu-don-t-ignore-rc-from-drm_dp_mst_topology_mgr_resume.patch
drm-amdgpu-don-t-fail-resume-process-if-resuming-atomic-state-fails.patch
rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch
+++ /dev/null
-From c4a32b266da7bb702e60381ca0c35eaddbc89a6c Mon Sep 17 00:00:00 2001
-From: Yu Zhao <yuzhao@google.com>
-Date: Mon, 7 Jan 2019 15:51:15 -0700
-Subject: drm/amdgpu: validate user GEM object size
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Yu Zhao <yuzhao@google.com>
-
-commit c4a32b266da7bb702e60381ca0c35eaddbc89a6c upstream.
-
-When creating frame buffer, userspace may request to attach to a
-previously allocated GEM object that is smaller than what GPU
-requires. Validation must be done to prevent out-of-bound DMA,
-otherwise it could be exploited to reveal sensitive data.
-
-This fix is not done in a common code path because individual
-driver might have different requirement.
-
-Cc: stable@vger.kernel.org # v4.2+
-Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
-Signed-off-by: Yu Zhao <yuzhao@google.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-@@ -552,6 +552,7 @@ amdgpu_user_framebuffer_create(struct dr
- struct drm_gem_object *obj;
- struct amdgpu_framebuffer *amdgpu_fb;
- int ret;
-+ int height;
- struct amdgpu_device *adev = dev->dev_private;
- int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
- int pitch = mode_cmd->pitches[0] / cpp;
-@@ -576,6 +577,13 @@ amdgpu_user_framebuffer_create(struct dr
- return ERR_PTR(-EINVAL);
- }
-
-+ height = ALIGN(mode_cmd->height, 8);
-+ if (obj->size < pitch * height) {
-+ DRM_DEBUG_KMS("Invalid GEM size: expecting >= %d but got %zu\n",
-+ pitch * height, obj->size);
-+ return ERR_PTR(-EINVAL);
-+ }
-+
- amdgpu_fb = kzalloc(sizeof(*amdgpu_fb), GFP_KERNEL);
- if (amdgpu_fb == NULL) {
- drm_gem_object_unreference_unlocked(obj);
+++ /dev/null
-From 89f23b6efef554766177bf51aa754bce14c3e7da Mon Sep 17 00:00:00 2001
-From: Yu Zhao <yuzhao@google.com>
-Date: Mon, 7 Jan 2019 15:51:14 -0700
-Subject: drm/amdgpu: validate user pitch alignment
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Yu Zhao <yuzhao@google.com>
-
-commit 89f23b6efef554766177bf51aa754bce14c3e7da upstream.
-
-Userspace may request pitch alignment that is not supported by GPU.
-Some requests 32, but GPU ignores it and uses default 64 when cpp is
-4. If GEM object is allocated based on the smaller alignment, GPU
-DMA will go out of bound.
-
-Cc: stable@vger.kernel.org # v4.2+
-Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
-Signed-off-by: Yu Zhao <yuzhao@google.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-@@ -552,6 +552,16 @@ amdgpu_user_framebuffer_create(struct dr
- struct drm_gem_object *obj;
- struct amdgpu_framebuffer *amdgpu_fb;
- int ret;
-+ struct amdgpu_device *adev = dev->dev_private;
-+ int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
-+ int pitch = mode_cmd->pitches[0] / cpp;
-+
-+ pitch = amdgpu_align_pitch(adev, pitch, cpp, false);
-+ if (mode_cmd->pitches[0] != pitch) {
-+ DRM_DEBUG_KMS("Invalid pitch: expecting %d but got %d\n",
-+ pitch, mode_cmd->pitches[0]);
-+ return ERR_PTR(-EINVAL);
-+ }
-
- obj = drm_gem_object_lookup(dev, file_priv, mode_cmd->handles[0]);
- if (obj == NULL) {
acpi-power-skip-duplicate-power-resource-references-in-_prx.patch
i2c-dev-prevent-adapter-retries-and-timeout-being-set-as-minus-value.patch
crypto-cts-fix-crash-on-short-inputs.patch
-drm-amdgpu-validate-user-pitch-alignment.patch
-drm-amdgpu-validate-user-gem-object-size.patch
ext4-fix-a-potential-fiemap-page-fault-deadlock-w-inline_data.patch
+++ /dev/null
-From c4a32b266da7bb702e60381ca0c35eaddbc89a6c Mon Sep 17 00:00:00 2001
-From: Yu Zhao <yuzhao@google.com>
-Date: Mon, 7 Jan 2019 15:51:15 -0700
-Subject: drm/amdgpu: validate user GEM object size
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Yu Zhao <yuzhao@google.com>
-
-commit c4a32b266da7bb702e60381ca0c35eaddbc89a6c upstream.
-
-When creating frame buffer, userspace may request to attach to a
-previously allocated GEM object that is smaller than what GPU
-requires. Validation must be done to prevent out-of-bound DMA,
-otherwise it could be exploited to reveal sensitive data.
-
-This fix is not done in a common code path because individual
-driver might have different requirement.
-
-Cc: stable@vger.kernel.org # v4.2+
-Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
-Signed-off-by: Yu Zhao <yuzhao@google.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-@@ -525,6 +525,7 @@ amdgpu_user_framebuffer_create(struct dr
- struct drm_gem_object *obj;
- struct amdgpu_framebuffer *amdgpu_fb;
- int ret;
-+ int height;
- struct amdgpu_device *adev = dev->dev_private;
- int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
- int pitch = mode_cmd->pitches[0] / cpp;
-@@ -549,6 +550,13 @@ amdgpu_user_framebuffer_create(struct dr
- return ERR_PTR(-EINVAL);
- }
-
-+ height = ALIGN(mode_cmd->height, 8);
-+ if (obj->size < pitch * height) {
-+ DRM_DEBUG_KMS("Invalid GEM size: expecting >= %d but got %zu\n",
-+ pitch * height, obj->size);
-+ return ERR_PTR(-EINVAL);
-+ }
-+
- amdgpu_fb = kzalloc(sizeof(*amdgpu_fb), GFP_KERNEL);
- if (amdgpu_fb == NULL) {
- drm_gem_object_unreference_unlocked(obj);
+++ /dev/null
-From 89f23b6efef554766177bf51aa754bce14c3e7da Mon Sep 17 00:00:00 2001
-From: Yu Zhao <yuzhao@google.com>
-Date: Mon, 7 Jan 2019 15:51:14 -0700
-Subject: drm/amdgpu: validate user pitch alignment
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Yu Zhao <yuzhao@google.com>
-
-commit 89f23b6efef554766177bf51aa754bce14c3e7da upstream.
-
-Userspace may request pitch alignment that is not supported by GPU.
-Some requests 32, but GPU ignores it and uses default 64 when cpp is
-4. If GEM object is allocated based on the smaller alignment, GPU
-DMA will go out of bound.
-
-Cc: stable@vger.kernel.org # v4.2+
-Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
-Signed-off-by: Yu Zhao <yuzhao@google.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
-@@ -525,6 +525,16 @@ amdgpu_user_framebuffer_create(struct dr
- struct drm_gem_object *obj;
- struct amdgpu_framebuffer *amdgpu_fb;
- int ret;
-+ struct amdgpu_device *adev = dev->dev_private;
-+ int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
-+ int pitch = mode_cmd->pitches[0] / cpp;
-+
-+ pitch = amdgpu_align_pitch(adev, pitch, cpp, false);
-+ if (mode_cmd->pitches[0] != pitch) {
-+ DRM_DEBUG_KMS("Invalid pitch: expecting %d but got %d\n",
-+ pitch, mode_cmd->pitches[0]);
-+ return ERR_PTR(-EINVAL);
-+ }
-
- obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[0]);
- if (obj == NULL) {
mm-page_mapped-don-t-assume-compound-page-is-huge-or-thp.patch
acpi-power-skip-duplicate-power-resource-references-in-_prx.patch
i2c-dev-prevent-adapter-retries-and-timeout-being-set-as-minus-value.patch
-drm-amdgpu-validate-user-pitch-alignment.patch
-drm-amdgpu-validate-user-gem-object-size.patch
rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch
ext4-make-sure-enough-credits-are-reserved-for-dioread_nolock-writes.patch
ext4-fix-a-potential-fiemap-page-fault-deadlock-w-inline_data.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
