1. 18 9月, 2020 3 次提交
  2. 17 9月, 2020 5 次提交
  3. 16 9月, 2020 15 次提交
  4. 15 9月, 2020 12 次提交
  5. 14 9月, 2020 5 次提交
    • D
      Merge v5.9-rc5 into drm-next · 818280d5
      Daniel Vetter 提交于
      Paul needs 1a21e5b9 ("drm/ingenic: Fix leak of device_node
      pointer") and 3b5b005e ("drm/ingenic: Fix driver not probing when
      IPU port is missing") from -fixes to be able to merge further ingenic
      patches into -next.
      Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      818280d5
    • J
      drm: fix double free for gbo in drm_gem_vram_init and drm_gem_vram_create · da62cb72
      Jia Yang 提交于
      I got a use-after-free report when doing some fuzz test:
      
      If ttm_bo_init() fails, the "gbo" and "gbo->bo.base" will be
      freed by ttm_buffer_object_destroy() in ttm_bo_init(). But
      then drm_gem_vram_create() and drm_gem_vram_init() will free
      "gbo" and "gbo->bo.base" again.
      
      BUG: KMSAN: use-after-free in drm_vma_offset_remove+0xb3/0x150
      CPU: 0 PID: 24282 Comm: syz-executor.1 Tainted: G    B   W         5.7.0-rc4-msan #2
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      Call Trace:
       __dump_stack
       dump_stack+0x1c9/0x220
       kmsan_report+0xf7/0x1e0
       __msan_warning+0x58/0xa0
       drm_vma_offset_remove+0xb3/0x150
       drm_gem_free_mmap_offset
       drm_gem_object_release+0x159/0x180
       drm_gem_vram_init
       drm_gem_vram_create+0x7c5/0x990
       drm_gem_vram_fill_create_dumb
       drm_gem_vram_driver_dumb_create+0x238/0x590
       drm_mode_create_dumb
       drm_mode_create_dumb_ioctl+0x41d/0x450
       drm_ioctl_kernel+0x5a4/0x710
       drm_ioctl+0xc6f/0x1240
       vfs_ioctl
       ksys_ioctl
       __do_sys_ioctl
       __se_sys_ioctl+0x2e9/0x410
       __x64_sys_ioctl+0x4a/0x70
       do_syscall_64+0xb8/0x160
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
      RIP: 0033:0x4689b9
      Code: fd e0 fa ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb e0 fa ff c3 66 2e 0f 1f 84 00 00 00 00
      RSP: 002b:00007f368fa4dc98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      RAX: ffffffffffffffda RBX: 000000000076bf00 RCX: 00000000004689b9
      RDX: 0000000020000240 RSI: 00000000c02064b2 RDI: 0000000000000003
      RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
      R13: 00000000004d17e0 R14: 00007f368fa4e6d4 R15: 000000000076bf0c
      
      Uninit was created at:
       kmsan_save_stack_with_flags
       kmsan_internal_poison_shadow+0x66/0xd0
       kmsan_slab_free+0x6e/0xb0
       slab_free_freelist_hook
       slab_free
       kfree+0x571/0x30a0
       drm_gem_vram_destroy
       ttm_buffer_object_destroy+0xc8/0x130
       ttm_bo_release
       kref_put
       ttm_bo_put+0x117d/0x23e0
       ttm_bo_init_reserved+0x11c0/0x11d0
       ttm_bo_init+0x289/0x3f0
       drm_gem_vram_init
       drm_gem_vram_create+0x775/0x990
       drm_gem_vram_fill_create_dumb
       drm_gem_vram_driver_dumb_create+0x238/0x590
       drm_mode_create_dumb
       drm_mode_create_dumb_ioctl+0x41d/0x450
       drm_ioctl_kernel+0x5a4/0x710
       drm_ioctl+0xc6f/0x1240
       vfs_ioctl
       ksys_ioctl
       __do_sys_ioctl
       __se_sys_ioctl+0x2e9/0x410
       __x64_sys_ioctl+0x4a/0x70
       do_syscall_64+0xb8/0x160
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      If ttm_bo_init() fails, the "gbo" will be freed by
      ttm_buffer_object_destroy() in ttm_bo_init(). But then
      drm_gem_vram_create() and drm_gem_vram_init() will free
      "gbo" again.
      Reported-by: NHulk Robot <hulkci@huawei.com>
      Reported-by: Nbutt3rflyh4ck <butterflyhuangxx@gmail.com>
      Signed-off-by: NJia Yang <jiayang5@huawei.com>
      Signed-off-by: NThomas Zimmermann <tzimmermann@suse.de>
      Reviewed-by: NThomas Zimmermann <tzimmermann@suse.de>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200714083238.28479-2-tzimmermann@suse.de
      da62cb72
    • T
      drm/vboxvideo: Use drm_gem_vram_vmap() interfaces · d88656f4
      Thomas Zimmermann 提交于
      VRAM helpers support ref counting for pin and vmap operations, no need
      to avoid these operations by employing the internal kmap interface. Just
      use drm_gem_vram_vmap() and let it handle the details.
      
      Also unexport the kmap interfaces from VRAM helpers. Vboxvideo was the
      last user of these internal functions.
      
      v2:
      	* fixed a comma in commit description
      Signed-off-by: NThomas Zimmermann <tzimmermann@suse.de>
      Reviewed-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      Tested-by: NHans de Goede <hdegoede@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200911075922.19317-1-tzimmermann@suse.de
      d88656f4
    • L
      Linux 5.9-rc5 · 856deb86
      Linus Torvalds 提交于
      856deb86
    • L
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · 5712c3ed
      Linus Torvalds 提交于
      Pull ARM SoC fixes from Olof Johansson:
       "A collection of fixes I've been accruing over the last few weeks, none
        of them have been severe enough to warrant flushing the queue but it's
        been long enough now that it's a good idea to send them in.
      
        A handful of them are fixups for QSPI DT/bindings/compatibles, some
        smaller fixes for system DMA clock control and TMU interrupts on i.MX,
        a handful of fixes for OMAP, including a fix for DSI (display) on
        omap5"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (27 commits)
        arm64: dts: ns2: Fixed QSPI compatible string
        ARM: dts: BCM5301X: Fixed QSPI compatible string
        ARM: dts: NSP: Fixed QSPI compatible string
        ARM: dts: bcm: HR2: Fixed QSPI compatible string
        dt-bindings: spi: Fix spi-bcm-qspi compatible ordering
        ARM: dts: imx6sx: fix the pad QSPI1B_SCLK mux mode for uart3
        arm64: dts: imx8mp: correct sdma1 clk setting
        arm64: dts: imx8mq: Fix TMU interrupt property
        ARM: dts: imx7d-zii-rmu2: fix rgmii phy-mode for ksz9031 phy
        ARM: dts: vfxxx: Add syscon compatible with OCOTP
        ARM: dts: imx6q-logicpd: Fix broken PWM
        arm64: dts: imx: Add missing imx8mm-beacon-kit.dtb to build
        ARM: dts: imx6q-prtwd2: Remove unneeded i2c unit name
        ARM: dts: imx6qdl-gw51xx: Remove unneeded #address-cells/#size-cells
        ARM: dts: imx7ulp: Correct gpio ranges
        ARM: dts: ls1021a: fix QuadSPI-memory reg range
        arm64: defconfig: Enable ptn5150 extcon driver
        arm64: defconfig: Enable USB gadget with configfs
        ARM: configs: Update Integrator defconfig
        ARM: dts: omap5: Fix DSI base address and clocks
        ...
      5712c3ed