1. 26 Oct, 2023 2 commits
  2. 25 Oct, 2023 1 commit
  3. 23 Oct, 2023 1 commit
  4. 22 Oct, 2023 1 commit
  5. 19 Oct, 2023 5 commits
  6. 18 Oct, 2023 2 commits
  7. 16 Oct, 2023 2 commits
  8. 12 Oct, 2023 6 commits
  9. 10 Oct, 2023 2 commits
  10. 09 Oct, 2023 2 commits
    • Zack Rusin's avatar
      drm/vmwgfx: Keep a gem reference to user bos in surfaces · 91398b41
      Zack Rusin authored
      Surfaces can be backed (i.e. stored in) memory objects (mob's) which
      are created and managed by the userspace as GEM buffers. Surfaces
      grab only a ttm reference which means that the gem object can
      be deleted underneath us, especially in cases where prime buffer
      export is used.
      
      Make sure that all userspace surfaces which are backed by gem objects
      hold a gem reference to make sure they're not deleted before vmw
      surfaces are done with them, which fixes:
      ------------[ cut here ]------------
      refcount_t: underflow; use-after-free.
      WARNING: CPU: 2 PID: 2632 at lib/refcount.c:28 refcount_warn_saturate+0xfb/0x150
      Modules linked in: overlay vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock snd_ens1371 snd_ac97_codec ac97_bus snd_pcm gameport>
      CPU: 2 PID: 2632 Comm: vmw_ref_count Not tainted 6.5.0-rc2-vmwgfx #1
      Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
      RIP: 0010:refcount_warn_saturate+0xfb/0x150
      Code: eb 9e 0f b6 1d 8b 5b a6 01 80 fb 01 0f 87 ba e4 80 00 83 e3 01 75 89 48 c7 c7 c0 3c f9 a3 c6 05 6f 5b a6 01 01 e8 15 81 98 ff <0f> 0b e9 6f ff ff ff 0f b>
      RSP: 0018:ffffbdc34344bba0 EFLAGS: 00010286
      RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000027
      RDX: ffff960475ea1548 RSI: 0000000000000001 RDI: ffff960475ea1540
      RBP: ffffbdc34344bba8 R08: 0000000000000003 R09: 65646e75203a745f
      R10: ffffffffa5b32b20 R11: 72657466612d6573 R12: ffff96037d6a6400
      R13: ffff9603484805b0 R14: 000000000000000b R15: ffff9603bed06060
      FS:  00007f5fd8520c40(0000) GS:ffff960475e80000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007f5fda755000 CR3: 000000010d012005 CR4: 00000000003706e0
      Call Trace:
       <TASK>
       ? show_regs+0x6e/0x80
       ? refcount_warn_saturate+0xfb/0x150
       ? __warn+0x91/0x150
       ? refcount_warn_saturate+0xfb/0x150
       ? report_bug+0x19d/0x1b0
       ? handle_bug+0x46/0x80
       ? exc_invalid_op+0x1d/0x80
       ? asm_exc_invalid_op+0x1f/0x30
       ? refcount_warn_saturate+0xfb/0x150
       drm_gem_object_handle_put_unlocked+0xba/0x110 [drm]
       drm_gem_object_release_handle+0x6e/0x80 [drm]
       drm_gem_handle_delete+0x6a/0xc0 [drm]
       ? __pfx_vmw_bo_unref_ioctl+0x10/0x10 [vmwgfx]
       vmw_bo_unref_ioctl+0x33/0x40 [vmwgfx]
       drm_ioctl_kernel+0xbc/0x160 [drm]
       drm_ioctl+0x2d2/0x580 [drm]
       ? __pfx_vmw_bo_unref_ioctl+0x10/0x10 [vmwgfx]
       ? do_vmi_munmap+0xee/0x180
       vmw_generic_ioctl+0xbd/0x180 [vmwgfx]
       vmw_unlocked_ioctl+0x19/0x20 [vmwgfx]
       __x64_sys_ioctl+0x99/0xd0
       do_syscall_64+0x5d/0x90
       ? syscall_exit_to_user_mode+0x2a/0x50
       ? do_syscall_64+0x6d/0x90
       ? handle_mm_fault+0x16e/0x2f0
       ? exit_to_user_mode_prepare+0x34/0x170
       ? irqentry_exit_to_user_mode+0xd/0x20
       ? irqentry_exit+0x3f/0x50
       ? exc_page_fault+0x8e/0x190
       entry_SYSCALL_64_after_hwframe+0x6e/0xd8
      RIP: 0033:0x7f5fda51aaff
      Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 7>
      RSP: 002b:00007ffd536a4d30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      RAX: ffffffffffffffda RBX: 00007ffd536a4de0 RCX: 00007f5fda51aaff
      RDX: 00007ffd536a4de0 RSI: 0000000040086442 RDI: 0000000000000003
      RBP: 0000000040086442 R08: 000055fa603ada50 R09: 0000000000000000
      R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffd536a51b8
      R13: 0000000000000003 R14: 000055fa5ebb4c80 R15: 00007f5fda90f040
       </TASK>
      ---[ end trace 0000000000000000 ]---
      
      A lot of the analyis on the bug was done by Murray McAllister and
      Ian Forbes.
      Reported-by: default avatarMurray McAllister <murray.mcallister@gmail.com>
      Cc: Ian Forbes <iforbes@vmware.com>
      Signed-off-by: default avatarZack Rusin <zackr@vmware.com>
      Fixes: a950b989 ("drm/vmwgfx: Do not drop the reference to the handle too soon")
      Cc: <stable@vger.kernel.org> # v6.2+
      Reviewed-by: default avatarMartin Krastev <krastevm@vmware.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20230928041355.737635-1-zack@kde.org
      91398b41
    • Konstantin Meskhidze's avatar
      drm/vmwgfx: fix typo of sizeof argument · 39465cac
      Konstantin Meskhidze authored
      Since size of 'header' pointer and '*header' structure is equal on 64-bit
      machines issue probably didn't cause any wrong behavior. But anyway,
      fixing typo is required.
      
      Fixes: 7a73ba74 ("drm/vmwgfx: Use TTM handles instead of SIDs as user-space surface handles.")
      Co-developed-by: default avatarIvanov Mikhail <ivanov.mikhail1@huawei-partners.com>
      Signed-off-by: default avatarKonstantin Meskhidze <konstantin.meskhidze@huawei.com>
      Reviewed-by: default avatarZack Rusin <zackr@vmware.com>
      Signed-off-by: default avatarZack Rusin <zackr@vmware.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20230905100203.1716731-1-konstantin.meskhidze@huawei.com
      39465cac
  11. 05 Oct, 2023 1 commit
  12. 03 Oct, 2023 4 commits
  13. 30 Sep, 2023 1 commit
  14. 27 Sep, 2023 6 commits
  15. 25 Sep, 2023 1 commit
  16. 21 Sep, 2023 1 commit
    • Thomas Zimmermann's avatar
      fbdev/sh7760fb: Depend on FB=y · f75f71b2
      Thomas Zimmermann authored
      Fix linker error if FB=m about missing fb_io_read and fb_io_write. The
      linker's error message suggests that this config setting has already
      been broken for other symbols.
      
        All errors (new ones prefixed by >>):
      
           sh4-linux-ld: drivers/video/fbdev/sh7760fb.o: in function `sh7760fb_probe':
           sh7760fb.c:(.text+0x374): undefined reference to `framebuffer_alloc'
           sh4-linux-ld: sh7760fb.c:(.text+0x394): undefined reference to `fb_videomode_to_var'
           sh4-linux-ld: sh7760fb.c:(.text+0x39c): undefined reference to `fb_alloc_cmap'
           sh4-linux-ld: sh7760fb.c:(.text+0x3a4): undefined reference to `register_framebuffer'
           sh4-linux-ld: sh7760fb.c:(.text+0x3ac): undefined reference to `fb_dealloc_cmap'
           sh4-linux-ld: sh7760fb.c:(.text+0x434): undefined reference to `framebuffer_release'
           sh4-linux-ld: drivers/video/fbdev/sh7760fb.o: in function `sh7760fb_remove':
           sh7760fb.c:(.text+0x800): undefined reference to `unregister_framebuffer'
           sh4-linux-ld: sh7760fb.c:(.text+0x804): undefined reference to `fb_dealloc_cmap'
           sh4-linux-ld: sh7760fb.c:(.text+0x814): undefined reference to `framebuffer_release'
        >> sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0xc): undefined reference to `fb_io_read'
        >> sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x10): undefined reference to `fb_io_write'
           sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x2c): undefined reference to `cfb_fillrect'
           sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x30): undefined reference to `cfb_copyarea'
           sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x34): undefined reference to `cfb_imageblit'
      Suggested-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Closes: https://lore.kernel.org/oe-kbuild-all/202309130632.LS04CPWu-lkp@intel.com/Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Reviewed-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
      Acked-by: default avatarJohn Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
      Link: https://patchwork.freedesktop.org/patch/msgid/20230918090400.13264-1-tzimmermann@suse.de
      f75f71b2
  17. 20 Sep, 2023 2 commits
    • José Pekkarinen's avatar
      drm/virtio: clean out_fence on complete_submit · 4556b93f
      José Pekkarinen authored
      The removed line prevents the following cleanup function
      to execute a dma_fence_put on the out_fence to free its
      memory, producing the following output in kmemleak:
      
      unreferenced object 0xffff888126d8ee00 (size 128):
        comm "kwin_wayland", pid 981, jiffies 4295380296 (age 390.060s)
        hex dump (first 32 bytes):
          c8 a1 c2 27 81 88 ff ff e0 14 a9 c0 ff ff ff ff  ...'............
          30 1a e1 2e a6 00 00 00 28 fc 5b 17 81 88 ff ff  0.......(.[.....
        backtrace:
          [<0000000011655661>] kmalloc_trace+0x26/0xa0
          [<0000000055f15b82>] virtio_gpu_fence_alloc+0x47/0xc0 [virtio_gpu]
          [<00000000fa6d96f9>] virtio_gpu_execbuffer_ioctl+0x1a8/0x800 [virtio_gpu]
          [<00000000e6cb5105>] drm_ioctl_kernel+0x169/0x240 [drm]
          [<000000005ad33e27>] drm_ioctl+0x399/0x6b0 [drm]
          [<00000000a19dbf65>] __x64_sys_ioctl+0xc5/0x100
          [<0000000011fa801e>] do_syscall_64+0x5b/0xc0
          [<0000000065c76d8a>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
      unreferenced object 0xffff888121930500 (size 128):
        comm "kwin_wayland", pid 981, jiffies 4295380313 (age 390.096s)
        hex dump (first 32 bytes):
          c8 a1 c2 27 81 88 ff ff e0 14 a9 c0 ff ff ff ff  ...'............
          f9 ec d7 2f a6 00 00 00 28 fc 5b 17 81 88 ff ff  .../....(.[.....
        backtrace:
          [<0000000011655661>] kmalloc_trace+0x26/0xa0
          [<0000000055f15b82>] virtio_gpu_fence_alloc+0x47/0xc0 [virtio_gpu]
          [<00000000fa6d96f9>] virtio_gpu_execbuffer_ioctl+0x1a8/0x800 [virtio_gpu]
          [<00000000e6cb5105>] drm_ioctl_kernel+0x169/0x240 [drm]
          [<000000005ad33e27>] drm_ioctl+0x399/0x6b0 [drm]
          [<00000000a19dbf65>] __x64_sys_ioctl+0xc5/0x100
          [<0000000011fa801e>] do_syscall_64+0x5b/0xc0
          [<0000000065c76d8a>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
      [...]
      
      This memleak will grow quickly, being possible to see the
      following line in dmesg after few minutes of life in the
      virtual machine:
      
      [  706.217388] kmemleak: 10731 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
      
      The patch will remove the line to allow the cleanup
      function do its job.
      Signed-off-by: default avatarJosé Pekkarinen <jose.pekkarinen@foxhound.fi>
      Fixes: e4812ab8 ("drm/virtio: Refactor and optimize job submission code path")
      Signed-off-by: default avatarDmitry Osipenko <dmitry.osipenko@collabora.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20230912060824.5210-1-jose.pekkarinen@foxhound.fi
      4556b93f
    • Jani Nikula's avatar
      drm/meson: fix memory leak on ->hpd_notify callback · 099f0af9
      Jani Nikula authored
      The EDID returned by drm_bridge_get_edid() needs to be freed.
      
      Fixes: 0af5e0b4 ("drm/meson: encoder_hdmi: switch to bridge DRM_BRIDGE_ATTACH_NO_CONNECTOR")
      Cc: Neil Armstrong <narmstrong@baylibre.com>
      Cc: Sam Ravnborg <sam@ravnborg.org>
      Cc: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
      Cc: Neil Armstrong <neil.armstrong@linaro.org>
      Cc: Kevin Hilman <khilman@baylibre.com>
      Cc: Jerome Brunet <jbrunet@baylibre.com>
      Cc: dri-devel@lists.freedesktop.org
      Cc: linux-amlogic@lists.infradead.org
      Cc: linux-arm-kernel@lists.infradead.org
      Cc: stable@vger.kernel.org # v5.17+
      Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
      Reviewed-by: default avatarNeil Armstrong <neil.armstrong@linaro.org>
      Signed-off-by: default avatarNeil Armstrong <neil.armstrong@linaro.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20230914131015.2472029-1-jani.nikula@intel.com
      099f0af9