kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers/gpu/drm
History
Jérôme Glisse 2719d3c05d drm/radeon: forbid mapping of userptr bo through radeon device file 
[ Upstream commit b5dcec693f ]

Allowing userptr bo which are basicly a list of page from some vma
(so either anonymous page or file backed page) would lead to serious
corruption of kernel structures and counters (because we overwrite
the page->mapping field when mapping buffer).

This will already block if the buffer was populated before anyone does
try to mmap it because then TTM_PAGE_FLAG_SG would be set in in the
ttm_tt flags. But that flag is check before ttm_tt_populate in the ttm
vm fault handler.

So to be safe just add a check to verify_access() callback.

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2016-05-10 12:17:32 -04:00
..
amd drm/amdkfd: fix topology bug with capability attr. 2015-06-03 21:45:54 +03:00
armada dma-buf: cleanup dma_buf_export() to make it easily extensible 2015-04-21 14:47:16 +05:30
ast drm/ast: Fix incorrect register check for DRAM width 2016-03-09 13:15:23 -05:00
atmel-hlcdc drm/atmel-hlcdc: Compile suspend/resume for PM_SLEEP only 2015-09-13 09:07:49 -07:00
bochs drm/bochs: disable video before changing video mode 2015-04-01 08:28:15 +10:00
bridge drm/bridge: ptn3460: Include linux/gpio/consumer.h 2015-08-03 09:29:08 -07:00
cirrus Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux 2015-02-16 15:48:00 -08:00
exynos drm/exynos: dp: Lower level of EDID read success message 2015-05-19 22:50:55 +09:00
gma500 drm/gma500: Use correct unref in the gem bo create function 2016-04-11 22:44:21 -04:00
i2c drm: adv7511: Refactor power management 2015-03-19 12:28:55 +02:00
i810 drm: move drm_mmap to <drm/drm_legacy.h> 2014-09-24 11:43:07 +10:00
i915 drm/i915: Use fw_domains_put_with_fifo() on HSW 2016-05-08 08:09:02 -04:00
imx Merge branch 'drm-dwhdmi-devel' of git://ftp.arm.linux.org.uk/~rmk/linux-arm into drm-next 2015-04-16 08:33:30 +10:00
mga drm: move drm_mmap to <drm/drm_legacy.h> 2014-09-24 11:43:07 +10:00
mgag200 drm/mgag200: Reject non-character-cell-aligned mode widths 2015-06-16 10:01:16 +10:00
msm drm/msm/mdp5: fix incorrect parameter for msm_framebuffer_iova() 2015-05-21 14:31:45 +10:00
nouveau drm/nouveau/kms: take mode_config mutex in connector hotplug path 2016-02-03 14:01:45 -05:00
omapdrm dma-buf: cleanup dma_buf_export() to make it easily extensible 2015-04-21 14:47:16 +05:30
panel drm/panel: Add support for Ampire AM-800480R3TMQW-A1H 800x480 7" panel 2015-04-02 19:04:15 +02:00
qxl drm/qxl: fix cursor position with non-zero hotspot 2016-04-20 01:03:42 -04:00
r128 drm: remove unnecessary sizeof(u8) 2014-11-20 11:30:37 +10:00
radeon drm/radeon: forbid mapping of userptr bo through radeon device file 2016-05-10 12:17:32 -04:00
rcar-du drm: Use of-graph helpers to loop over endpoints 2015-04-13 17:28:16 +10:00
rockchip drm/rockchip: use drm_gem_mmap helpers 2015-08-03 09:29:10 -07:00
savage drm: move drm_mmap to <drm/drm_legacy.h> 2014-09-24 11:43:07 +10:00
shmobile drm: Kconfig: Let all DRM_GEM_CMA_HELPER related macros depend on HAVE_DMA_ATTRS 2015-02-03 11:12:37 +10:00
sis drm: move drm_mmap to <drm/drm_legacy.h> 2014-09-24 11:43:07 +10:00
sti drm: sti: convert driver to atomic modeset 2015-03-19 13:35:16 +01:00
tdfx drm: move drm_mmap to <drm/drm_legacy.h> 2014-09-24 11:43:07 +10:00
tegra drm/tegra: dpaux: Fix transfers larger than 4 bytes 2015-08-03 09:29:08 -07:00
tilcdc drm: Kconfig: Let all DRM_GEM_CMA_HELPER related macros depend on HAVE_DMA_ATTRS 2015-02-03 11:12:37 +10:00
ttm dma-buf: cleanup dma_buf_export() to make it easily extensible 2015-04-21 14:47:16 +05:30
udl dma-buf: cleanup dma_buf_export() to make it easily extensible 2015-04-21 14:47:16 +05:30
vgem drm/vgem: Set unique to "vgem" 2015-08-03 09:29:08 -07:00
via drm: move drm_mmap to <drm/drm_legacy.h> 2014-09-24 11:43:07 +10:00
vmwgfx drm/vmwgfx: respect 'nomodeset' 2016-02-15 15:45:26 -05:00
ati_pcigart.c drm: split ati_pcigart.h out of drmP.h 2014-09-12 14:11:14 +10:00
drm_agpsupport.c drm: move AGP definitions harder 2014-09-10 17:40:11 +10:00
drm_atomic.c drm/atomic: Add for_each_{connector,crtc,plane}_in_state helper macros 2015-04-11 18:50:22 +02:00
drm_atomic_helper.c Merge tag 'topic/drm-misc-2015-04-15' of git://anongit.freedesktop.org/drm-intel into drm-next 2015-04-16 08:34:24 +10:00
drm_auth.c drm: Move piles of functions from drmP.h to drm_internal.h 2014-09-12 11:16:29 +02:00
drm_bridge.c drm: Silence sparse warnings 2015-03-13 17:37:35 +01:00
drm_bufs.c drm: Move __drm_pci_free to drm_legacy.h 2014-09-12 11:08:56 +02:00
drm_cache.c drm/cache: Use wbinvd helpers 2014-12-16 08:56:55 +01:00
drm_context.c drm: mark drm_context support as legacy 2014-08-05 19:38:12 +02:00
drm_crtc.c drm: Stop resetting connector state to unknown 2015-08-03 09:29:10 -07:00
drm_crtc_helper.c drm/drm: constify all struct drm_*_helper funcs pointers 2015-04-07 18:11:25 +02:00
drm_crtc_internal.h drm/atomic: Hide drm.ko internal interfaces 2015-01-05 13:55:30 +01:00
drm_debugfs.c drm: Move piles of functions from drmP.h to drm_internal.h 2014-09-12 11:16:29 +02:00
drm_dma.c drm: Move legacy buffer structures to <drm/drm_legacy.h> 2014-09-12 15:28:12 +02:00
drm_dp_helper.c drm/dp: Print the number of bytes processed for aux nacks 2015-03-23 16:22:29 +01:00
drm_dp_mst_topology.c drm/dp/mst: Validate port in drm_dp_payload_send_msg() 2016-05-10 12:17:32 -04:00
drm_drv.c drm: %pF is only for function pointers 2015-03-13 10:17:38 +01:00
drm_edid.c Merge tag 'topic/core-stuff-2014-12-10' of git://anongit.freedesktop.org/drm-intel into drm-next 2014-12-11 10:12:57 +10:00
drm_edid_load.c drm/edid: set ELD for firmware and debugfs override EDIDs 2015-03-27 13:27:04 +02:00
drm_encoder_slave.c drm: encoder_slave: Don't use i2c_client->driver 2013-10-03 22:28:28 +02:00
drm_fb_cma_helper.c drm/cma: use correct fb width/height 2015-03-11 22:08:07 +01:00
drm_fb_helper.c drm/drm: constify all struct drm_*_helper funcs pointers 2015-04-07 18:11:25 +02:00
drm_flip_work.c drm: flip-work: change drm_flip_work_init prototype 2014-11-15 09:29:14 +10:00
drm_fops.c drm: Make drm_read() more robust against multithreaded races 2015-01-21 14:57:03 +01:00
drm_gem.c drm: Sanitize DRM_IOCTL_MODE_CREATE_DUMB input 2014-11-15 09:50:21 +10:00
drm_gem_cma_helper.c drm/cma: Remove call to drm_gem_free_mmap_offset() 2014-11-13 13:27:33 +01:00
drm_global.c drm: Remove unused variable in drm_global_item_ref() 2013-10-01 15:28:58 +10:00
drm_hashtab.c list: fix order of arguments for hlist_add_after(_rcu) 2014-08-06 18:01:24 -07:00
drm_info.c drm: Silence sparse warnings 2015-03-13 17:37:35 +01:00
drm_internal.h drm/info: Remove unused code 2014-12-16 18:44:34 +01:00
drm_ioc32.c drm: Provide compat ioctl for addfb2.1 2015-08-03 09:29:10 -07:00
drm_ioctl.c drm: line wrap DRM_IOCTL_DEF* macros 2015-03-31 09:18:40 +02:00
drm_irq.c drm: Zero out invalid vblank timestamp in drm_update_vblank_count. 2015-05-11 06:02:38 +10:00
drm_legacy.h drm: Create drm legacy driver header 2014-09-12 11:08:55 +02:00
drm_lock.c drm: Reject DRI1 hw lock ioctl functions for kms drivers 2015-10-22 14:43:19 -07:00
drm_memory.c drm: Move drm_memory.c map support declarations to <drm/drm_legacy.h> 2014-09-12 15:28:12 +02:00
drm_mipi_dsi.c drm/mipi-dsi: Avoid potential NULL pointer dereference 2015-01-28 08:45:37 +01:00
drm_mm.c [PATCH] drm/mm: Fix support 4 GiB and larger ranges 2015-03-16 06:28:50 +10:00
drm_modes.c drm: mode: Allow NULL modes for equality check 2015-03-23 16:22:30 +01:00
drm_modeset_lock.c drm: Per-plane locking 2014-11-12 17:56:12 +10:00
drm_of.c drm: use for_each_endpoint_of_node macro in drm_of_find_possible_crtcs 2015-04-08 11:14:25 +02:00
drm_panel.c drm: Add panel support 2013-12-17 18:09:46 +01:00
drm_pci.c drm: Silence sparse warnings 2015-03-13 17:37:35 +01:00
drm_plane_helper.c drm/plane-helper: Adapt cursor hack to transitional helpers 2015-05-22 08:48:08 +03:00
drm_platform.c drm: Goody bye, drm_bus! 2014-09-10 17:43:10 +10:00
drm_prime.c dma-buf: cleanup dma_buf_export() to make it easily extensible 2015-04-21 14:47:16 +05:30
drm_probe_helper.c drm: Don't overwrite UNVERFIED mode status to OK 2016-02-01 11:37:23 -05:00
drm_rect.c drm: Add drm_rect rotation functions 2014-07-11 23:44:12 +02:00
drm_scatter.c drm: Move sg functions into drm_legacy.h 2014-09-12 11:08:54 +02:00
drm_sysfs.c drm: Fix locking for sysfs dpms file 2015-10-27 09:51:53 +09:00
drm_trace.h tracing/drm: Remove unused TRACE_SYSTEM_STRING define 2015-04-07 12:29:23 -04:00
drm_trace_points.c UAPI: (Scripted) Convert #include "..." to #include <path/...> in drivers/gpu/ 2012-10-02 18:01:07 +01:00
drm_vm.c drm: Silence sparse warnings 2015-03-13 17:37:35 +01:00
drm_vma_manager.c mm: remove rest usage of VM_NONLINEAR and pte_file() 2015-02-10 14:30:31 -08:00
Kconfig drm/vgem: implement virtual GEM 2015-04-02 09:21:48 +10:00
Makefile drm/vgem: implement virtual GEM 2015-04-02 09:21:48 +10:00