kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Chris Wilson 142c6a6040 drm/i915: Check for rq->hwsp validity after acquiring RCU lock 
commit 45db630e5f upstream.

Since we allow removing the timeline map at runtime, there is a risk
that rq->hwsp points into a stale page. To control that risk, we hold
the RCU read lock while reading *rq->hwsp, but we missed a couple of
important barriers. First, the unpinning / removal of the timeline map
must be after all RCU readers into that map are complete, i.e. after an
rcu barrier (in this case courtesy of call_rcu()). Secondly, we must
make sure that the rq->hwsp we are about to dereference under the RCU
lock is valid. In this case, we make the rq->hwsp pointer safe during
i915_request_retire() and so we know that rq->hwsp may become invalid
only after the request has been signaled. Therefore is the request is
not yet signaled when we acquire rq->hwsp under the RCU, we know that
rq->hwsp will remain valid for the duration of the RCU read lock.

This is a very small window that may lead to either considering the
request not completed (causing a delay until the request is checked
again, any wait for the request is not affected) or dereferencing an
invalid pointer.

Fixes: 3adac4689f ("drm/i915: Introduce concept of per-timeline (context) HWSP")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: <stable@vger.kernel.org> # v5.1+
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201218122421.18344-1-chris@chris-wilson.co.uk
(cherry picked from commit 9bb36cf660)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210118101755.476744-1-chris@chris-wilson.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2021-01-27 11:54:56 +01:00
..
accessibility speakup: fix uninitialized flush_lock 2020-12-30 11:53:44 +01:00
acpi ACPI: scan: Make acpi_bus_get_device() clear return pointer on error 2021-01-27 11:54:52 +01:00
amba ARM: tegra: Replace zero-length array with flexible-array 2020-06-15 23:08:28 -05:00
android binder: add flag to clear buffer on txn complete 2020-12-30 11:54:09 +01:00
ata libata-5.10-2020-10-30 2020-10-30 14:51:01 -07:00
atm atm: idt77252: call pci_disable_device() on error path 2021-01-12 20:18:09 +01:00
auxdisplay A trivial patch for auxdisplay: 2020-09-05 14:22:46 -07:00
base regmap: debugfs: Fix a reversed if statement in regmap_debugfs_init() 2021-01-17 14:17:06 +01:00
bcma bcma: use semicolons rather than commas to separate statements 2020-10-01 16:23:50 +03:00
block block/rnbd-clt: avoid module unload race with close confirmation 2021-01-17 14:17:05 +01:00
bluetooth Bluetooth: revert: hci_h5: close serdev device and free hu in h5_close 2021-01-12 20:18:16 +01:00
bus bus: fsl-mc: fix error return code in fsl_mc_object_allocate() 2020-12-30 11:53:46 +01:00
cdrom gdrom: use bdev_check_media_change 2020-09-10 09:32:31 -06:00
char um: random: Register random as hwrng-core device 2021-01-06 14:56:55 +01:00
clk clk: tegra: Do not return 0 on failure 2020-12-30 11:54:26 +01:00
clocksource clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI 2020-12-30 11:53:37 +01:00
connector connector: simplify the return expression of cn_add_callback() 2020-09-21 13:48:29 -07:00
counter counter: microchip-tcb-capture: Fix CMR value check 2020-12-30 11:54:26 +01:00
cpufreq cpufreq: powernow-k8: pass policy rather than use cpufreq_cpu_get() 2021-01-17 14:17:00 +01:00
cpuidle cpuidle: tegra: Annotate tegra_pm_set_cpu_in_lp2() with RCU_NONIDLE 2020-11-16 13:24:32 +01:00
crypto crypto: atmel-i2c - select CONFIG_BITREVERSE 2020-12-30 11:53:50 +01:00
dax device-dax: Fix range release 2021-01-06 14:56:56 +01:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: tegra30: Improve initial hardware resetting 2020-09-29 17:50:10 +09:00
dio maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault 2020-06-17 10:57:41 -07:00
dma dmaengine: xilinx_dma: fix mixed_enum_type coverity warning 2021-01-17 14:17:02 +01:00
dma-buf dmabuf: fix use-after-free of dmabuf's file->f_inode 2021-01-12 20:18:24 +01:00
edac EDAC/amd64: Fix PCI component registration 2020-12-30 11:54:11 +01:00
eisa treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
extcon extcon: max77693: Fix modalias string 2020-12-30 11:53:49 +01:00
firewire firewire-ohci: use dma_alloc_pages 2020-09-25 06:20:48 +02:00
firmware mm/gup: prevent gup_fast from racing with COW during fork 2020-12-30 11:53:54 +01:00
fpga fpga: Specify HAS_IOMEM dependency for FPGA_DFL 2020-12-01 18:46:24 +01:00
fsi fsi: Aspeed: Add mutex to protect HW access 2020-12-30 11:53:46 +01:00
gnss treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
gpio gpiolib: irq hooks: fix recursion in gpiochip_irq_unmask 2020-12-30 11:53:51 +01:00
gpu drm/i915: Check for rq->hwsp validity after acquiring RCU lock 2021-01-27 11:54:56 +01:00
greybus drivers/greybus: Use kobj_to_dev() 2020-09-04 18:06:01 +02:00
hid HID: wacom: Fix memory leakage caused by kfifo_alloc 2021-01-17 14:16:59 +01:00
hsi HSI: omap_ssi: Don't jump to free ID in ssi_add_controller() 2020-12-30 11:53:24 +01:00
hv hyperv-fixes for 5.10-rc5 2020-11-16 15:02:33 -08:00
hwmon hwmon: (pwm-fan) Ensure that calculation doesn't discard big period values 2021-01-19 18:27:25 +01:00
hwspinlock hwspinlock: qcom: Allow mmio usage in addition to syscon 2020-07-13 22:29:28 -07:00
hwtracing coresight: remove broken __exit annotations 2020-12-30 11:53:44 +01:00
i2c i2c: bpmp-tegra: Ignore unknown I2C_M flags 2021-01-27 11:54:50 +01:00
i3c i3c master: fix missing destroy_workqueue() on error in i3c_master_register 2021-01-06 14:56:53 +01:00
ide scsi: ide: Mark power management requests with RQF_PM instead of RQF_PREEMPT 2021-01-12 20:18:15 +01:00
idle intel_idle: Build fix 2020-12-03 10:00:23 +01:00
iio iio:adc:ti-ads124s08: Fix alignment and data leak issues. 2020-12-30 11:54:25 +01:00
infiniband IB/mlx5: Fix error unwinding when set_has_smi_cap fails 2021-01-19 18:27:32 +01:00
input Input: cyapa_gen6 - fix out-of-bounds stack access 2020-12-30 11:54:05 +01:00
interconnect interconnect: qcom: fix rpmh link failures 2021-01-17 14:17:01 +01:00
iommu iommu/vt-d: Fix unaligned addresses for intel_flush_svm_range_dev() 2021-01-19 18:27:33 +01:00
ipack treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
irqchip irqchip/qcom-pdc: Fix phantom irq when changing between rising/falling 2020-12-30 11:53:51 +01:00
isdn misdn: dsp: select CONFIG_BITREVERSE 2021-01-19 18:27:26 +01:00
leds leds: turris-omnia: check for LED_COLOR_ID_RGB instead LED_COLOR_ID_MULTI 2020-12-30 11:53:22 +01:00
lightnvm lightnvm: select CONFIG_CRC32 2021-01-17 14:17:03 +01:00
macintosh macintosh/adb-iop: Send correct poll command 2020-12-30 11:53:39 +01:00
mailbox mailbox: arm_mhu_db: Fix mhu_db_shutdown by replacing kfree with devm_kfree 2020-12-30 11:53:28 +01:00
mcb drivers: mcb: use symbol namespaces 2019-11-03 19:54:53 +01:00
md dm integrity: conditionally disable "recalculate" feature 2021-01-27 11:54:55 +01:00
media media: gp8psk: initialize stats at power control logic 2021-01-06 14:56:52 +01:00
memory memory: renesas-rpc-if: Fix unbalanced pm_runtime_enable in rpcif_{enable,disable}_rpm 2020-12-30 11:54:27 +01:00
memstick memstick: r592: Fix error return in r592_probe() 2020-12-30 11:53:34 +01:00
message scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() 2020-10-26 16:57:18 -04:00
mfd mfd: cpcap: Fix interrupt regression with regmap clear_ack 2020-12-30 11:53:16 +01:00
misc habanalabs: Fix memleak in hl_device_reset 2021-01-19 18:27:25 +01:00
mmc mmc: sdhci-brcmstb: Fix mmc timeout errors on S5 suspend 2021-01-27 11:54:54 +01:00
most drivers: most: add character device interface driver 2020-09-07 15:16:26 +02:00
mtd mtd: rawnand: nandsim: Fix the logic when selecting Hamming soft ECC engine 2021-01-27 11:54:50 +01:00
mux treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
net cxgb4/chtls: Fix tid stuck due to wrong update of qid 2021-01-23 16:04:05 +01:00
nfc nfc: s3fwrn5: Release the nfc firmware 2020-12-30 11:53:53 +01:00
ntb Bug fixes for v5.10 2020-10-25 11:12:31 -07:00
nubus nubus: Remove cast to void pointer 2019-10-21 09:08:15 +02:00
nvdimm libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels 2020-12-30 11:54:27 +01:00
nvme nvme-tcp: Fix warning with CONFIG_DEBUG_PREEMPT 2021-01-19 18:27:30 +01:00
nvmem nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell() 2020-09-27 14:25:48 +02:00
of of/address: Fix of_node memory leak in of_dma_is_coherent 2020-11-11 17:10:16 -06:00
opp opp: Call the missing clk_put() on error 2021-01-06 14:56:49 +01:00
oprofile module: Fix up module_notifier return values 2020-09-01 09:58:03 +02:00
parisc dma-mapping: split <linux/dma-mapping.h> 2020-10-06 07:07:03 +02:00
parport treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
pci PCI: Fix pci_slot_release() NULL pointer dereference 2020-12-30 11:54:28 +01:00
pcmcia dma-mapping: remove DMA_MASK_NONE 2020-09-25 06:12:15 +02:00
perf perf: arm-cmn: Fix conversion specifiers for node type 2020-10-01 22:30:07 +01:00
phy drm/mediatek: avoid dereferencing a null hdmi_phy on an error message 2020-12-30 11:53:43 +01:00
pinctrl pinctrl: ingenic: Fix JZ4760 support 2021-01-27 11:54:53 +01:00
platform platform/x86: ideapad-laptop: Disable touchpad_switch for ELAN0634 2021-01-27 11:54:51 +01:00
pnp PNP: fix kernel-doc markups 2020-10-27 19:23:04 +01:00
power power: supply: bq24190_charger: fix reference leak 2020-12-30 11:53:25 +01:00
powercap Merge branch 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux 2020-11-10 10:02:31 -08:00
pps treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
ps3 powerpc/ps3: use dma_mapping_error() 2020-12-30 11:53:53 +01:00
ptp phy: dp83640: select CONFIG_CRC32 2021-01-17 14:17:02 +01:00
pwm pwm: sun4i: Remove erroneous else branch 2020-12-30 11:53:59 +01:00
rapidio rapidio: fix the missed put_device() for rio_mport_add_riodev 2020-10-16 11:11:22 -07:00
ras RAS/CEC: Convert to DEFINE_SHOW_ATTRIBUTE() 2020-09-25 19:05:31 +02:00
regulator regulator: bd718x7: Add enable times 2021-01-19 18:27:24 +01:00
remoteproc remoteproc: sysmon: Ensure remote notification ordering 2020-12-30 11:54:28 +01:00
reset ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
rpmsg rpmsg updates for 5.10 2020-10-22 12:58:21 -07:00
rtc rtc: pcf2127: only use watchdog when explicitly available 2021-01-09 13:46:22 +01:00
s390 s390/qeth: fix L2 header access in qeth_l3_osa_features_check() 2021-01-17 14:16:58 +01:00
sbus treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
scsi scsi: ufs: Fix possible power drain during system suspend 2021-01-19 18:27:31 +01:00
sfi treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
sh iomap: constify ioreadX() iomem argument (as in generic implementation) 2020-08-14 19:56:57 -07:00
siox siox: Use the correct style for SPDX License Identifier 2020-01-14 21:46:53 +01:00
slimbus slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew() 2020-12-30 11:53:47 +01:00
soc soc: qcom: smp2p: Safely acquire spinlock without IRQs 2020-12-30 11:54:22 +01:00
soundwire soundwire: master: use pm_runtime_set_active() on add 2020-12-30 11:53:28 +01:00
spi spi: cadence: cache reference clock rate during probe 2021-01-23 16:04:05 +01:00
spmi spmi: pmic-arb: Set lockdep class for hierarchical irq domains 2020-02-10 13:16:04 +01:00
ssb ssb: Remove meaningless jump label to simplify the code 2020-09-21 16:01:35 +03:00
staging staging: spmi: hisi-spmi-controller: Fix some error handling paths 2021-01-19 18:27:25 +01:00
target scsi: target: tcmu: Fix use-after-free of se_cmd->priv 2021-01-27 11:54:50 +01:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee ARM: SoC fixes for v5.10, part 3 2020-11-27 14:48:03 -08:00
thermal thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed 2020-12-30 11:54:29 +01:00
thunderbolt thunderbolt: Fix use-after-free in remove_unplugged_switch() 2020-11-19 17:44:10 +03:00
tty m68k: Fix WARNING splat in pmac_zilog driver 2020-12-30 11:54:11 +01:00
uio uio: Fix use-after-free in uio_unregister_device() 2020-11-09 18:54:30 +01:00
usb usb: typec: Fix copy paste error for NVIDIA alt-mode description 2021-01-19 18:27:27 +01:00
vdpa vdpa/mlx5: Use write memory barrier after updating CQ index 2020-12-30 11:54:00 +01:00
vfio vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU 2020-12-30 11:54:03 +01:00
vhost vhost_net: fix ubuf refcount incorrectly when sendmsg fails 2021-01-12 20:18:13 +01:00
video fbcon: Disable accelerated scrolling 2021-01-06 14:56:51 +01:00
virt nitro_enclaves: Fixup type and simplify logic of the poll mask setup 2020-11-09 18:20:36 +01:00
virtio virtio_ring: Fix two use after free bugs 2020-12-30 11:54:00 +01:00
visorbus treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
vlynq treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 102 2019-05-24 17:39:00 +02:00
vme treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
w1 w1: w1_therm: make w1_poll_completion static 2020-10-05 14:49:24 +02:00
watchdog watchdog: rti-wdt: fix reference leak in rti_wdt_probe 2021-01-06 14:56:54 +01:00
xen xen/privcmd: allow fetching resource sizes 2021-01-19 18:27:21 +01:00
zorro zorro: Fix address space collision message with RAM expansion boards 2020-08-26 13:26:52 +02:00
Kconfig virtio: fixes, vdpa 2020-04-08 10:51:53 -07:00
Makefile vdpa: mlx5: fix vdpa/vhost dependencies 2020-12-02 04:09:56 -05:00