1. 01 5月, 2020 2 次提交
  2. 30 4月, 2020 1 次提交
  3. 29 4月, 2020 12 次提交
  4. 28 4月, 2020 7 次提交
    • V
      drm/qxl: qxl_release leak in qxl_hw_surface_alloc() · a65aa9c3
      Vasily Averin 提交于
      Cc: stable@vger.kernel.org
      Fixes: 8002db63 ("qxl: convert qxl driver to proper use for reservations")
      Signed-off-by: NVasily Averin <vvs@virtuozzo.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/2e5a13ae-9ab2-5401-aa4d-03d5f5593423@virtuozzo.comSigned-off-by: NGerd Hoffmann <kraxel@redhat.com>
      a65aa9c3
    • V
      drm/qxl: qxl_release leak in qxl_draw_dirty_fb() · 85e9b88a
      Vasily Averin 提交于
      ret should be changed to release allocated struct qxl_release
      
      Cc: stable@vger.kernel.org
      Fixes: 8002db63 ("qxl: convert qxl driver to proper use for reservations")
      Signed-off-by: NVasily Averin <vvs@virtuozzo.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/22cfd55f-07c8-95d0-a2f7-191b7153c3d4@virtuozzo.comSigned-off-by: NGerd Hoffmann <kraxel@redhat.com>
      85e9b88a
    • G
      drm/virtio: only destroy created contexts · 45c5d2a4
      Gurchetan Singh 提交于
      This can happen if userspace doesn't issue any 3D ioctls before
      closing the DRM fd.
      
      Fixes: 72b48ae8 ("drm/virtio: enqueue virtio_gpu_create_context after the first 3D ioctl")
      Signed-off-by: NGurchetan Singh <gurchetansingh@chromium.org>
      Link: http://patchwork.freedesktop.org/patch/msgid/20200408232938.55816-1-gurchetansingh@chromium.orgSigned-off-by: NGerd Hoffmann <kraxel@redhat.com>
      45c5d2a4
    • L
      drm/dp_mst: Fix drm_dp_send_dpcd_write() return code · dbc05ae3
      Lyude Paul 提交于
      drm_dp_mst_wait_tx_reply() returns > 1 if time elapsed in
      wait_event_timeout() before check_txmsg_state(mgr, txmsg) evaluated to
      true. However, we make the mistake of returning this time from
      drm_dp_send_dpcd_write() on success instead of returning the number of
      bytes written - causing spontaneous failures during link probing:
      
      [drm:drm_dp_send_link_address [drm_kms_helper]] *ERROR* GUID check on
      10:01 failed: 3975
      
      Yikes! So, fix this by returning the number of bytes written on success
      instead.
      Signed-off-by: NLyude Paul <lyude@redhat.com>
      Fixes: cb897542 ("drm/dp_mst: Fix W=1 warnings")
      Cc: Benjamin Gaignard <benjamin.gaignard@st.com>
      Cc: Sean Paul <sean@poorly.run>
      Acked-by: NAlex Deucher <alexander.deucher@amd.com>
      Reviewed-by: NSean Paul <sean@poorly.run>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200424190722.775284-1-lyude@redhat.com
      dbc05ae3
    • C
      drm/i915/gt: Check cacheline is valid before acquiring · 2abaad4e
      Chris Wilson 提交于
      The hwsp_cacheline pointer from i915_request is very, very flimsy. The
      i915_request.timeline (and the hwsp_cacheline) are lost upon retiring
      (after an RCU grace). Therefore we need to confirm that once we have the
      right pointer for the cacheline, it is not in the process of being
      retired and disposed of before we attempt to acquire a reference to the
      cacheline.
      
      <3>[  547.208237] BUG: KASAN: use-after-free in active_debug_hint+0x6a/0x70 [i915]
      <3>[  547.208366] Read of size 8 at addr ffff88822a0d2710 by task gem_exec_parall/2536
      
      <4>[  547.208547] CPU: 3 PID: 2536 Comm: gem_exec_parall Tainted: G     U            5.7.0-rc2-ged7a286b5d02d-kasan_117+ #1
      <4>[  547.208556] Hardware name: Dell Inc. XPS 13 9350/, BIOS 1.4.12 11/30/2016
      <4>[  547.208564] Call Trace:
      <4>[  547.208579]  dump_stack+0x96/0xdb
      <4>[  547.208707]  ? active_debug_hint+0x6a/0x70 [i915]
      <4>[  547.208719]  print_address_description.constprop.6+0x16/0x310
      <4>[  547.208841]  ? active_debug_hint+0x6a/0x70 [i915]
      <4>[  547.208963]  ? active_debug_hint+0x6a/0x70 [i915]
      <4>[  547.208975]  __kasan_report+0x137/0x190
      <4>[  547.209106]  ? active_debug_hint+0x6a/0x70 [i915]
      <4>[  547.209127]  kasan_report+0x32/0x50
      <4>[  547.209257]  ? i915_gemfs_fini+0x40/0x40 [i915]
      <4>[  547.209376]  active_debug_hint+0x6a/0x70 [i915]
      <4>[  547.209389]  debug_print_object+0xa7/0x220
      <4>[  547.209405]  ? lockdep_hardirqs_on+0x348/0x5f0
      <4>[  547.209426]  debug_object_assert_init+0x297/0x430
      <4>[  547.209449]  ? debug_object_free+0x360/0x360
      <4>[  547.209472]  ? lock_acquire+0x1ac/0x8a0
      <4>[  547.209592]  ? intel_timeline_read_hwsp+0x4f/0x840 [i915]
      <4>[  547.209737]  ? i915_active_acquire_if_busy+0x66/0x120 [i915]
      <4>[  547.209861]  i915_active_acquire_if_busy+0x66/0x120 [i915]
      <4>[  547.209990]  ? __live_alloc.isra.15+0xc0/0xc0 [i915]
      <4>[  547.210005]  ? rcu_read_lock_sched_held+0xd0/0xd0
      <4>[  547.210017]  ? print_usage_bug+0x580/0x580
      <4>[  547.210153]  intel_timeline_read_hwsp+0xbc/0x840 [i915]
      <4>[  547.210284]  __emit_semaphore_wait+0xd5/0x480 [i915]
      <4>[  547.210415]  ? i915_fence_get_timeline_name+0x110/0x110 [i915]
      <4>[  547.210428]  ? lockdep_hardirqs_on+0x348/0x5f0
      <4>[  547.210442]  ? _raw_spin_unlock_irq+0x2a/0x40
      <4>[  547.210567]  ? __await_execution.constprop.51+0x2e0/0x570 [i915]
      <4>[  547.210706]  i915_request_await_dma_fence+0x8f7/0xc70 [i915]
      
      Fixes: 85bedbf1 ("drm/i915/gt: Eliminate the trylock for reading a timeline's hwsp")
      Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Cc: <stable@vger.kernel.org> # v5.6+
      Reviewed-by: NTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200427093038.29219-1-chris@chris-wilson.co.uk
      (cherry picked from commit 2759e395)
      Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>
      2abaad4e
    • C
      drm/i915/gem: Hold obj->vma.lock over for_each_ggtt_vma() · f524a774
      Chris Wilson 提交于
      While the ggtt vma are protected by their object lifetime, the list
      continues until it hits a non-ggtt vma, and that vma is not protected
      and may be freed as we inspect it. Hence, we require the obj->vma.lock
      to protect the list as we iterate.
      
      An example of forgetting to hold the obj->vma.lock is
      
      [1642834.464973] general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] SMP PTI
      [1642834.464977] CPU: 3 PID: 1954 Comm: Xorg Not tainted 5.6.0-300.fc32.x86_64 #1
      [1642834.464979] Hardware name: LENOVO 20ARS25701/20ARS25701, BIOS GJET94WW (2.44 ) 09/14/2017
      [1642834.465021] RIP: 0010:i915_gem_object_set_tiling+0x2c0/0x3e0 [i915]
      [1642834.465024] Code: 8b 84 24 18 01 00 00 f6 c4 80 74 59 49 8b 94 24 a0 00 00 00 49 8b 84 24 e0 00 00 00 49 8b 74 24 10 48 8b 92 30 01 00 00 89 c7 <80> ba 0a 06 00 00 03 0f 87 86 00 00 00 ba 00 00 08 00 b9 00 00 10
      [1642834.465025] RSP: 0018:ffffa98780c77d60 EFLAGS: 00010282
      [1642834.465028] RAX: ffff8d232bfb2578 RBX: 0000000000000002 RCX: ffff8d25873a0000
      [1642834.465029] RDX: dead000000000122 RSI: fffff0af8ac6e408 RDI: 000000002bfb2578
      [1642834.465030] RBP: ffff8d25873a0000 R08: ffff8d252bfb5638 R09: 0000000000000000
      [1642834.465031] R10: 0000000000000000 R11: ffff8d252bfb5640 R12: ffffa987801cb8f8
      [1642834.465032] R13: 0000000000001000 R14: ffff8d233e972e50 R15: ffff8d233e972d00
      [1642834.465034] FS:  00007f6a3d327f00(0000) GS:ffff8d25926c0000(0000) knlGS:0000000000000000
      [1642834.465036] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [1642834.465037] CR2: 00007f6a2064d000 CR3: 00000002fb57c001 CR4: 00000000001606e0
      [1642834.465038] Call Trace:
      [1642834.465083]  i915_gem_set_tiling_ioctl+0x122/0x230 [i915]
      [1642834.465121]  ? i915_gem_object_set_tiling+0x3e0/0x3e0 [i915]
      [1642834.465151]  drm_ioctl_kernel+0x86/0xd0 [drm]
      [1642834.465156]  ? avc_has_perm+0x3b/0x160
      [1642834.465178]  drm_ioctl+0x206/0x390 [drm]
      [1642834.465216]  ? i915_gem_object_set_tiling+0x3e0/0x3e0 [i915]
      [1642834.465221]  ? selinux_file_ioctl+0x122/0x1c0
      [1642834.465226]  ? __do_munmap+0x24b/0x4d0
      [1642834.465231]  ksys_ioctl+0x82/0xc0
      [1642834.465235]  __x64_sys_ioctl+0x16/0x20
      [1642834.465238]  do_syscall_64+0x5b/0xf0
      [1642834.465243]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [1642834.465245] RIP: 0033:0x7f6a3d7b047b
      [1642834.465247] Code: 0f 1e fa 48 8b 05 1d aa 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ed a9 0c 00 f7 d8 64 89 01 48
      [1642834.465249] RSP: 002b:00007ffe71adba28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      [1642834.465251] RAX: ffffffffffffffda RBX: 000055f99048fa40 RCX: 00007f6a3d7b047b
      [1642834.465253] RDX: 00007ffe71adba30 RSI: 00000000c0106461 RDI: 000000000000000e
      [1642834.465254] RBP: 0000000000000002 R08: 000055f98f3f1798 R09: 0000000000000002
      [1642834.465255] R10: 0000000000001000 R11: 0000000000000246 R12: 0000000000000080
      [1642834.465257] R13: 000055f98f3f1690 R14: 00000000c0106461 R15: 00007ffe71adba30
      
      Now to take the spinlock during the list iteration, we need to break it
      down into two phases. In the first phase under the lock, we cannot sleep
      and so must defer the actual work to a second list, protected by the
      ggtt->mutex.
      
      We also need to hold the spinlock during creation of a new vma to
      serialise with updates of the tiling on the object.
      Reported-by: NDave Airlie <airlied@redhat.com>
      Fixes: 2850748e ("drm/i915: Pull i915_vma_pin under the vm->mutex")
      Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Cc: Dave Airlie <airlied@redhat.com>
      Cc: <stable@vger.kernel.org> # v5.5+
      Reviewed-by: NTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200422072805.17340-1-chris@chris-wilson.co.uk
      (cherry picked from commit cb593e5d)
      Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>
      f524a774
    • X
      drm/i915/selftests: Fix i915_address_space refcnt leak · 5d5e100a
      Xiyu Yang 提交于
      igt_ppgtt_pin_update() invokes i915_gem_context_get_vm_rcu(), which
      returns a reference of the i915_address_space object to "vm" with
      increased refcount.
      
      When igt_ppgtt_pin_update() returns, "vm" becomes invalid, so the
      refcount should be decreased to keep refcount balanced.
      
      The reference counting issue happens in two exception handling paths of
      igt_ppgtt_pin_update(). When i915_gem_object_create_internal() returns
      IS_ERR, the refcnt increased by i915_gem_context_get_vm_rcu() is not
      decreased, causing a refcnt leak.
      
      Fix this issue by jumping to "out_vm" label when
      i915_gem_object_create_internal() returns IS_ERR.
      
      Fixes: a4e7ccda ("drm/i915: Move context management under GEM")
      Signed-off-by: NXiyu Yang <xiyuyang19@fudan.edu.cn>
      Signed-off-by: NXin Tan <tanxin.ctf@gmail.com>
      Reviewed-by: NChris Wilson <chris@chris-wilson.co.uk>
      Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
      Link: https://patchwork.freedesktop.org/patch/msgid/1587361342-83494-1-git-send-email-xiyuyang19@fudan.edu.cn
      (cherry picked from commit e07c7606)
      Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>
      5d5e100a
  5. 27 4月, 2020 1 次提交
  6. 26 4月, 2020 1 次提交
  7. 25 4月, 2020 3 次提交
    • D
      net: systemport: suppress warnings on failed Rx SKB allocations · 3554e54a
      Doug Berger 提交于
      The driver is designed to drop Rx packets and reclaim the buffers
      when an allocation fails, and the network interface needs to safely
      handle this packet loss. Therefore, an allocation failure of Rx
      SKBs is relatively benign.
      
      However, the output of the warning message occurs with a high
      scheduling priority that can cause excessive jitter/latency for
      other high priority processing.
      
      This commit suppresses the warning messages to prevent scheduling
      problems while retaining the failure count in the statistics of
      the network interface.
      Signed-off-by: NDoug Berger <opendmb@gmail.com>
      Acked-by: NFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3554e54a
    • D
      net: bcmgenet: suppress warnings on failed Rx SKB allocations · ecaeceb8
      Doug Berger 提交于
      The driver is designed to drop Rx packets and reclaim the buffers
      when an allocation fails, and the network interface needs to safely
      handle this packet loss. Therefore, an allocation failure of Rx
      SKBs is relatively benign.
      
      However, the output of the warning message occurs with a high
      scheduling priority that can cause excessive jitter/latency for
      other high priority processing.
      
      This commit suppresses the warning messages to prevent scheduling
      problems while retaining the failure count in the statistics of
      the network interface.
      Signed-off-by: NDoug Berger <opendmb@gmail.com>
      Acked-by: NFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ecaeceb8
    • T
      macsec: avoid to set wrong mtu · 7f327080
      Taehee Yoo 提交于
      When a macsec interface is created, the mtu is calculated with the lower
      interface's mtu value.
      If the mtu of lower interface is lower than the length, which is needed
      by macsec interface, macsec's mtu value will be overflowed.
      So, if the lower interface's mtu is too low, macsec interface's mtu
      should be set to 0.
      
      Test commands:
          ip link add dummy0 mtu 10 type dummy
          ip link add macsec0 link dummy0 type macsec
          ip link show macsec0
      
      Before:
          11: macsec0@dummy0: <BROADCAST,MULTICAST,M-DOWN> mtu 4294967274
      After:
          11: macsec0@dummy0: <BROADCAST,MULTICAST,M-DOWN> mtu 0
      
      Fixes: c09440f7 ("macsec: introduce IEEE 802.1AE driver")
      Signed-off-by: NTaehee Yoo <ap420073@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      7f327080
  8. 24 4月, 2020 13 次提交