kernel.git/drivers/gpu/drm/vmwgfx, branch linux-3.2.y

drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()

2017-09-15T17:30:51Z

commit f0c62e9878024300319ba2438adc7b06c6b9c448 upstream. If vmalloc() fails then we need to a bit of cleanup before returning. Fixes: fb1d9738ca05 ("drm/vmwgfx: Add DRM driver for VMware Virtual GPU") Signed-off-by: Dan Carpenter Reviewed-by: Sinclair Yeh Signed-off-by: Ben Hutchings

drm/vmwgfx: Remove getparam error message

2017-07-18T17:38:39Z

commit 53e16798b0864464c5444a204e1bb93ae246c429 upstream. The mesa winsys sometimes uses unimplemented parameter requests to check for features. Remove the error message to avoid bloating the kernel log. Signed-off-by: Thomas Hellstrom Reviewed-by: Brian Paul Reviewed-by: Sinclair Yeh Signed-off-by: Ben Hutchings

drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()

2017-07-18T17:38:39Z

commit 63774069d9527a1aeaa4aa20e929ef5e8e9ecc38 upstream. In vmw_get_cap_3d_ioctl(), a user can supply 0 for a size that is used in vzalloc(). This eventually calls dump_stack() (in warn_alloc()), which can leak useful addresses to dmesg. Add check to avoid a size of 0. Signed-off-by: Murray McAllister Reviewed-by: Sinclair Yeh Signed-off-by: Ben Hutchings

drm/vmwgfx: Type-check lookups of fence objects

2017-07-18T17:38:38Z

commit f7652afa8eadb416b23eb57dec6f158529942041 upstream. A malicious caller could otherwise hand over handles to other objects causing all sorts of interesting problems. Testing done: Ran a Fedora 25 desktop using both Xorg and gnome-shell/Wayland. Signed-off-by: Thomas Hellstrom Reviewed-by: Sinclair Yeh [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings

drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()

2017-06-05T20:13:53Z

commit e7e11f99564222d82f0ce84bd521e57d78a6b678 upstream. In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the 'req->mip_levels' array. This array can be assigned any value from the user space. As both the 'num_sizes' and the array is uint32_t, it is easy to make 'num_sizes' overflow. The later 'mip_levels' is used as the loop count. This can lead an oob write. Add the check of 'req->mip_levels' to avoid this. Signed-off-by: Li Qiang Reviewed-by: Thomas Hellstrom [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings

drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()

2017-06-05T20:13:53Z

commit 36274ab8c596f1240c606bb514da329add2a1bcd upstream. Before memory allocations vmw_surface_define_ioctl() checks the upper-bounds of a user-supplied size, but does not check if the supplied size is 0. Add check to avoid NULL pointer dereferences. Signed-off-by: Murray McAllister Reviewed-by: Sinclair Yeh [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings

drm/vmwgfx: respect 'nomodeset'

2016-02-27T14:28:44Z

commit 96c5d076f0a5e2023ecdb44d8261f87641ee71e0 upstream. Signed-off-by: Rob Clark Reviewed-by: Thomas Hellstrom . Signed-off-by: Dave Airlie Signed-off-by: Ben Hutchings

drm/vmwgfx: Reorder device takedown somewhat

2015-05-09T22:16:29Z

commit 3458390b9f0ba784481d23134798faee27b5f16f upstream. To take down the MOB and GMR memory types, the driver may have to issue fence objects and thus make sure that the fence manager is taken down after those memory types. Reorder device init accordingly. Signed-off-by: Thomas Hellstrom Reviewed-by: Sinclair Yeh [bwh: Backported to 3.2: - Adjust context - Only the GMR memory type is used] Signed-off-by: Ben Hutchings

drm/vmwgfx: Don't use memory accounting for kernel-side fence objects

2015-02-20T00:49:29Z

commit 1f563a6a46544602183e7493b6ef69769d3d76d9 upstream. Kernel side fence objects are used when unbinding resources and may thus be created as part of a memory reclaim operation. This might trigger recursive memory reclaims and result in the kernel running out of stack space. So a simple way out is to avoid accounting of these fence objects. In principle this is OK since while user-space can trigger the creation of such objects, it can't really hold on to them. However, their lifetime is quite long, so some form of accounting should perhaps be implemented in the future. Fixes kernel crashes when running, for example viewperf11 ensight-04 test 3 with low system memory settings. Signed-off-by: Thomas Hellstrom Reviewed-by: Jakob Bornecrantz Reviewed-by: Sinclair Yeh [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings

drm/vmwgfx: Filter out modes those cannot be supported by the current VRAM size.

2014-12-14T16:23:54Z

commit 9a72384d86b26cb8a2b25106677e1197f606668f upstream. When screen objects are enabled, the bpp is assumed to be 32, otherwise it is set to 16. v2: * Use u32 instead of u64 for assumed_bpp. * Fixed mechanism to check for screen objects * Limit the back buffer size to VRAM. Signed-off-by: Sinclair Yeh Reviewed-by: Thomas Hellstrom [bwh: Backported to 3.2: drop changes for dev_priv->prim_bb_mem] Signed-off-by: Ben Hutchings