kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/drivers/gpu/drm/imagination
History
Shuvam Pandey 8dc8f3f4c2 drm/imagination: Fix user array stride in pvr_set_uobj_array() 
pvr_set_uobj_array() copies an array of kernel objects to a userspace
array whose element size is described by out->stride. When out->stride
is different from the kernel object size, the slow path advances the
userspace pointer by the kernel object size and the kernel pointer by the
userspace stride.

This reverses the intended layout. For larger userspace strides, later
copies read from the wrong kernel addresses. For smaller userspace
strides, later copies are written at the wrong userspace offsets. The
padding clear is also done only for the first element instead of the
padding area for each element.

Advance the userspace pointer by out->stride and the kernel pointer by
obj_size, and clear per-element padding while the current userspace
pointer is still available.

Fixes: f99f5f3ea7 ("drm/imagination: Add GPU ID parsing and firmware loading")
Cc: stable@vger.kernel.org # v6.8+
Reviewed-by: Alessio Belle <alessio.belle@imgtec.com>
Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com>
Link: https://patch.msgid.link/6a456012.eb165e5c.113c2a.b71d@mx.google.com
Signed-off-by: Alessio Belle <alessio.belle@imgtec.com>
History 2026-07-02 11:16:18 +01:00
..
Kconfig drm/imagination: KUnit test for pvr_gpuid_decode_string() 2026-01-19 11:20:22 +00:00
Makefile drm/imagination: Add support for trace points 2026-05-19 12:47:19 +01:00
pvr_ccb.c drm/imagination: Implement handling of context reset notification 2026-03-24 08:22:21 +00:00
pvr_ccb.h drm/imagination: Implement firmware infrastructure and META FW support 2023-11-23 09:01:46 +01:00
pvr_cccb.c drm/imagination: Implement context creation/destruction ioctls 2023-11-23 09:01:46 +01:00
pvr_cccb.h drm/imagination: Numerous documentation fixes. 2023-11-28 18:56:03 +01:00
pvr_context.c drm/imagination: Fix double call to drm_sched_entity_fini() 2026-07-02 11:15:35 +01:00
pvr_context.h drm/imagination: Break an object reference loop 2024-11-04 09:41:38 +00:00
pvr_debugfs.c drm/imagination: Simplify module parameters 2026-01-19 11:20:21 +00:00
pvr_debugfs.h drm/imagination: Add firmware trace to debugfs 2023-11-23 09:01:47 +01:00
pvr_device.c drm/imagination: Access FW initialised state with READ/WRITE_ONCE 2026-05-19 12:40:15 +01:00
pvr_device.h drm/imagination: Use dev_pm_domain_attach_list() 2026-02-06 10:18:30 +00:00
pvr_device_info.c drm/imagination: Fixed warning due to implicit cast to bool 2023-12-04 09:41:34 +01:00
pvr_device_info.h drm/imagination: Add GPU ID parsing and firmware loading 2023-11-23 09:01:46 +01:00
pvr_drv.c drm/imagination: Fix user array stride in pvr_set_uobj_array() 2026-07-02 11:16:18 +01:00
pvr_drv.h drm: remove driver date from struct drm_driver and all drivers 2024-12-05 12:35:42 +02:00
pvr_dump.c drm/imagination: Implement handling of context reset notification 2026-03-24 08:22:21 +00:00
pvr_dump.h drm/imagination: Implement handling of context reset notification 2026-03-24 08:22:21 +00:00
pvr_free_list.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pvr_free_list.h drm/imagination: Implement free list and HWRT create and destroy ioctls 2023-11-23 09:01:46 +01:00
pvr_fw.c drm/imagination: Access FW initialised state with READ/WRITE_ONCE 2026-05-19 12:40:15 +01:00
pvr_fw.h drm/imagination: Rename FW booted to FW initialised 2026-05-19 12:40:15 +01:00
pvr_fw_info.h drm/imagination: Numerous documentation fixes. 2023-11-28 18:56:03 +01:00
pvr_fw_meta.c drm: include drm_print.h where needed 2025-10-31 10:34:52 +02:00
pvr_fw_meta.h drm/imagination: Implement firmware infrastructure and META FW support 2023-11-23 09:01:46 +01:00
pvr_fw_mips.c drm/imagination: Move ELF fw utils to common file 2025-04-15 12:21:52 +01:00
pvr_fw_mips.h drm/imagination: Ensure PVR_MIPS_PT_PAGE_COUNT is never zero 2024-04-29 12:31:28 +01:00
pvr_fw_riscv.c drm/imagination: Add RISC-V firmware processor support 2025-04-15 12:21:52 +01:00
pvr_fw_startstop.c drm/imagination: Skip 2nd thread DM association for non META Firmware 2026-03-23 15:02:05 +00:00
pvr_fw_startstop.h drm/imagination: Implement firmware infrastructure and META FW support 2023-11-23 09:01:46 +01:00
pvr_fw_trace.c Merge drm/drm-next into drm-misc-next 2026-05-07 16:17:01 +02:00
pvr_fw_trace.h drm/imagination: Simplify module parameters 2026-01-19 11:20:21 +00:00
pvr_fw_util.c drm/imagination: Move ELF fw utils to common file 2025-04-15 12:21:52 +01:00
pvr_gem.c drm/gem-shmem: Track folio accessed/dirty status in vmap 2026-03-11 09:33:43 +01:00
pvr_gem.h drm/imagination: Use cached memory with dma_coherent 2025-04-15 12:21:52 +01:00
pvr_hwrt.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pvr_hwrt.h drm/imagination: Numerous documentation fixes. 2023-11-28 18:56:03 +01:00
pvr_job.c drm/imagination: Add support for trace points 2026-05-19 12:47:19 +01:00
pvr_job.h drm/imagination: Implement job submission and scheduling 2023-11-23 09:01:47 +01:00
pvr_mmu.c drm/imagination: Access FW initialised state with READ/WRITE_ONCE 2026-05-19 12:40:15 +01:00
pvr_mmu.h drm/imagination: Add GEM and VM related code 2023-11-23 09:01:46 +01:00
pvr_power.c drm/imagination: Fix missing argument in pvr_power_fw_{en,dis}able() 2026-05-20 10:52:10 +02:00
pvr_power.h drm/imagination: Discard pm_runtime_put() return value 2026-01-08 15:19:15 +01:00
pvr_queue.c drm/imagination: Fix double call to drm_sched_entity_fini() 2026-07-02 11:15:35 +01:00
pvr_queue.h drm/imagination: Fix double call to drm_sched_entity_fini() 2026-07-02 11:15:35 +01:00
pvr_rogue_cr_defs.h drm/imagination: Update register defs for newer GPUs 2025-04-15 12:21:50 +01:00
pvr_rogue_cr_defs_client.h drm/imagination: Add GPU register headers 2023-11-23 09:01:45 +01:00
pvr_rogue_defs.h drm/imagination: Add GPU register headers 2023-11-23 09:01:45 +01:00
pvr_rogue_fwif.h drm/imagination: Switch reset_reason fields from enum to u32 2026-03-24 08:19:59 +00:00
pvr_rogue_fwif_check.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_client.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_client_check.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_common.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_dev_info.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_resetframework.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_sf.h drm/imagination: Fix a couple of spelling mistakes in literal strings 2023-11-28 13:55:37 +01:00
pvr_rogue_fwif_shared.h drm/imagination: Minor improvements to job submission code documentation 2026-04-08 11:17:14 +01:00
pvr_rogue_fwif_shared_check.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_stream.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_heap_config.h drm/imagination: Add firmware and MMU related headers 2023-11-23 09:01:45 +01:00
pvr_rogue_meta.h drm/imagination: Add firmware and MMU related headers 2023-11-23 09:01:45 +01:00
pvr_rogue_mips.h drm/imagination: Add firmware and MMU related headers 2023-11-23 09:01:45 +01:00
pvr_rogue_mips_check.h drm/imagination: Add firmware and MMU related headers 2023-11-23 09:01:45 +01:00
pvr_rogue_mmu_defs.h drm/imagination: Add firmware and MMU related headers 2023-11-23 09:01:45 +01:00
pvr_rogue_riscv.h drm/imagination: Add RISC-V firmware processor support 2025-04-15 12:21:52 +01:00
pvr_stream.c drm/imagination: loop counters moved to loop scope 2025-04-07 10:09:40 +01:00
pvr_stream.h drm/imagination: Implement context creation/destruction ioctls 2023-11-23 09:01:46 +01:00
pvr_stream_defs.c drm/imagination: Implement job submission and scheduling 2023-11-23 09:01:47 +01:00
pvr_stream_defs.h drm/imagination: Implement context creation/destruction ioctls 2023-11-23 09:01:46 +01:00
pvr_sync.c drm/imagination: Rename fence returned by pvr_queue_job_arm() 2026-04-08 11:17:13 +01:00
pvr_sync.h drm/imagination: Rename fence returned by pvr_queue_job_arm() 2026-04-08 11:17:13 +01:00
pvr_test.c drm/imagination: KUnit test for pvr_gpuid_decode_string() 2026-01-19 11:20:22 +00:00
pvr_trace.h drm/imagination: Add support for trace points 2026-05-19 12:47:19 +01:00
pvr_trace_points.c drm/imagination: Add support for trace points 2026-05-19 12:47:19 +01:00
pvr_vm.c drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY 2026-07-02 11:15:59 +01:00
pvr_vm.h drm/imagination: Hold drm_gem_gpuva lock for unmap 2025-03-03 12:09:00 +00:00
pvr_vm_mips.c drm/imagination: loop counters moved to loop scope 2025-04-07 10:09:40 +01:00
pvr_vm_mips.h drm/imagination: Implement MIPS firmware processor and MMU support 2023-11-23 09:01:46 +01:00