1. 28 Mar, 2022 8 commits
  2. 25 Mar, 2022 3 commits
    • Cong Liu's avatar
      drm/qxl: fix qxl can't use in arm64 · 59ab4ee0
      Cong Liu authored
      qxl use ioremap to map ram_header and rom, in the arm64 implementation,
      the device is mapped as DEVICE_nGnRE, it can not support unaligned
      access. and qxl is a virtual device, it can be treated more like RAM
      than actual MMIO registers. use ioremap_wc() replace it.
      Signed-off-by: default avatarCong Liu <liucong2@kylinos.cn>
      Acked-by: default avatarChristian König <christian.koenig@amd.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20220324104928.2959545-1-liucong2@kylinos.cnSigned-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
      59ab4ee0
    • Rob Clark's avatar
      drm/virtio: Remove restriction of non-zero blob_flags · ec3cbb30
      Rob Clark authored
      With native userspace drivers in guest, a lot of GEM objects need to be
      neither shared nor mappable.  And in fact making everything mappable
      and/or sharable results in unreasonably high fd usage in host VMM.
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      Reviewed-by: default avatarChia-I Wu <olvaffe@gmail.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20220219170301.545432-1-robdclark@gmail.comSigned-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
      ec3cbb30
    • Liu Zixian's avatar
      drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes · 194d250c
      Liu Zixian authored
      drm_cvt_mode may return NULL and we should check it.
      
      This bug is found by syzkaller:
      
      FAULT_INJECTION stacktrace:
      [  168.567394] FAULT_INJECTION: forcing a failure.
      name failslab, interval 1, probability 0, space 0, times 1
      [  168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1
      [  168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
      [  168.567408] Call trace:
      [  168.567414]  dump_backtrace+0x0/0x310
      [  168.567418]  show_stack+0x28/0x38
      [  168.567423]  dump_stack+0xec/0x15c
      [  168.567427]  should_fail+0x3ac/0x3d0
      [  168.567437]  __should_failslab+0xb8/0x120
      [  168.567441]  should_failslab+0x28/0xc0
      [  168.567445]  kmem_cache_alloc_trace+0x50/0x640
      [  168.567454]  drm_mode_create+0x40/0x90
      [  168.567458]  drm_cvt_mode+0x48/0xc78
      [  168.567477]  virtio_gpu_conn_get_modes+0xa8/0x140 [virtio_gpu]
      [  168.567485]  drm_helper_probe_single_connector_modes+0x3a4/0xd80
      [  168.567492]  drm_mode_getconnector+0x2e0/0xa70
      [  168.567496]  drm_ioctl_kernel+0x11c/0x1d8
      [  168.567514]  drm_ioctl+0x558/0x6d0
      [  168.567522]  do_vfs_ioctl+0x160/0xf30
      [  168.567525]  ksys_ioctl+0x98/0xd8
      [  168.567530]  __arm64_sys_ioctl+0x50/0xc8
      [  168.567536]  el0_svc_common+0xc8/0x320
      [  168.567540]  el0_svc_handler+0xf8/0x160
      [  168.567544]  el0_svc+0x10/0x218
      
      KASAN stacktrace:
      [  168.567561] BUG: KASAN: null-ptr-deref in virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu]
      [  168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425
      [  168.567566]
      [  168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1
      [  168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
      [  168.567575] Call trace:
      [  168.567578]  dump_backtrace+0x0/0x310
      [  168.567582]  show_stack+0x28/0x38
      [  168.567586]  dump_stack+0xec/0x15c
      [  168.567591]  kasan_report+0x244/0x2f0
      [  168.567594]  __asan_load4+0x58/0xb0
      [  168.567607]  virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu]
      [  168.567612]  drm_helper_probe_single_connector_modes+0x3a4/0xd80
      [  168.567617]  drm_mode_getconnector+0x2e0/0xa70
      [  168.567621]  drm_ioctl_kernel+0x11c/0x1d8
      [  168.567624]  drm_ioctl+0x558/0x6d0
      [  168.567628]  do_vfs_ioctl+0x160/0xf30
      [  168.567632]  ksys_ioctl+0x98/0xd8
      [  168.567636]  __arm64_sys_ioctl+0x50/0xc8
      [  168.567641]  el0_svc_common+0xc8/0x320
      [  168.567645]  el0_svc_handler+0xf8/0x160
      [  168.567649]  el0_svc+0x10/0x218
      Signed-off-by: default avatarLiu Zixian <liuzixian4@huawei.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20220322091730.1653-1-liuzixian4@huawei.comSigned-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
      194d250c
  3. 24 Mar, 2022 15 commits
  4. 23 Mar, 2022 7 commits
  5. 21 Mar, 2022 6 commits
  6. 18 Mar, 2022 1 commit
    • Chuansheng Liu's avatar
      fbdev: defio: fix the pagelist corruption · 856082f0
      Chuansheng Liu authored
      Easily hit the below list corruption:
      ==
      list_add corruption. prev->next should be next (ffffffffc0ceb090), but
      was ffffec604507edc8. (prev=ffffec604507edc8).
      WARNING: CPU: 65 PID: 3959 at lib/list_debug.c:26
      __list_add_valid+0x53/0x80
      CPU: 65 PID: 3959 Comm: fbdev Tainted: G     U
      RIP: 0010:__list_add_valid+0x53/0x80
      Call Trace:
       <TASK>
       fb_deferred_io_mkwrite+0xea/0x150
       do_page_mkwrite+0x57/0xc0
       do_wp_page+0x278/0x2f0
       __handle_mm_fault+0xdc2/0x1590
       handle_mm_fault+0xdd/0x2c0
       do_user_addr_fault+0x1d3/0x650
       exc_page_fault+0x77/0x180
       ? asm_exc_page_fault+0x8/0x30
       asm_exc_page_fault+0x1e/0x30
      RIP: 0033:0x7fd98fc8fad1
      ==
      
      Figure out the race happens when one process is adding &page->lru into
      the pagelist tail in fb_deferred_io_mkwrite(), another process is
      re-initializing the same &page->lru in fb_deferred_io_fault(), which is
      not protected by the lock.
      
      This fix is to init all the page lists one time during initialization,
      it not only fixes the list corruption, but also avoids INIT_LIST_HEAD()
      redundantly.
      
      V2: change "int i" to "unsigned int i" (Geert Uytterhoeven)
      Signed-off-by: default avatarChuansheng Liu <chuansheng.liu@intel.com>
      Fixes: 105a9404 ("fbdev/defio: Early-out if page is already enlisted")
      Cc: Thomas Zimmermann <tzimmermann@suse.de>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Reviewed-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
      Reviewed-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220318005003.51810-1-chuansheng.liu@intel.com
      856082f0