mirror_ubuntu-kernels/drivers/gpu/drm
Zack Rusin 9ef8d83e8e drm/vmwgfx: Do not drop the reference to the handle too soon
v3: Fix vmw_user_bo_lookup which was also dropping the gem reference
before the kernel was done with buffer depending on userspace doing
the right thing. Same bug, different spot.

It is possible for userspace to predict the next buffer handle and
to destroy the buffer while it's still used by the kernel. Delay
dropping the internal reference on the buffers until kernel is done
with them.

Instead of immediately dropping the gem reference in vmw_user_bo_lookup
and vmw_gem_object_create_with_handle let the callers decide when they're
ready give the control back to userspace.

Also fixes the second usage of vmw_gem_object_create_with_handle in
vmwgfx_surface.c which wasn't grabbing an explicit reference
to the gem object which could have been destroyed by the userspace
on the owning surface at any point.

Signed-off-by: Zack Rusin <zackr@vmware.com>
Fixes: 8afa13a058 ("drm/vmwgfx: Implement DRIVER_GEM")
Reviewed-by: Martin Krastev <krastevm@vmware.com>
Reviewed-by: Maaz Mombasawala <mombasawalam@vmware.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230211050514.2431155-1-zack@kde.org
2023-02-14 22:06:19 -05:00
..
amd drm/amdgpu: Remove TTM resource->start visible VRAM condition v2 2023-02-09 15:10:36 +01:00
arm drm/arm/malidp: use sysfs_emit in show function callback 2023-02-03 13:05:33 +00:00
armada drm/fb-helper: Initialize fb-helper's preferred BPP in prepare function 2023-01-26 08:52:31 +01:00
aspeed drm/aspeed: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:31 +01:00
ast drm/ast: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:31 +01:00
atmel-hlcdc drm: atmel-hlcdc: Remove #ifdef guards for PM related functions 2022-12-12 12:30:56 +00:00
bridge drm/bridge: panel: Set orientation on panel_bridge connector 2023-02-06 16:50:57 -08:00
display Merge tag 'amd-drm-next-6.3-2023-01-27' of https://gitlab.freedesktop.org/agd5f/linux into drm-next 2023-01-30 15:37:57 +10:00
etnaviv MM patches for 6.2-rc1. 2022-12-13 19:29:45 -08:00
exynos drm/fb-helper: Initialize fb-helper's preferred BPP in prepare function 2023-01-26 08:52:31 +01:00
fsl-dcu hardening updates for v6.2-rc1 2022-12-14 12:20:00 -08:00
gma500 drm/fb-helper: Initialize fb-helper's preferred BPP in prepare function 2023-01-26 08:52:31 +01:00
gud drm/gud: use new debugfs device-centered functions 2023-01-06 16:15:08 -03:00
hisilicon drm: Only select I2C_ALGOBIT for drivers that actually need it 2023-01-10 11:15:44 +01:00
hyperv drm/fb-helper: Remove unnecessary include statements 2022-11-05 17:12:04 +01:00
i2c drm-misc-next for $kernel-version: 2023-01-24 17:36:29 +01:00
i915 drm/i915/ttm: audit remaining bo->resource 2023-02-06 12:10:07 +01:00
imx drm/imx/dcss: Don't call dev_set_drvdata(..., NULL); 2023-01-10 16:26:06 +02:00
ingenic drm/ingenic: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:31 +01:00
kmb drm/kmb: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:31 +01:00
lib
lima Linux 6.1-rc6 2022-11-24 11:05:43 +10:00
logicvc drm/logicvc: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:31 +01:00
mcde drm/fb-helper: Move generic fbdev emulation into separate source file 2022-11-05 17:12:04 +01:00
mediatek drm-misc-next for v6.3: 2023-01-04 14:59:25 +01:00
meson Linux 6.2-rc6 2023-01-31 12:23:23 +01:00
mgag200 drm: Only select I2C_ALGOBIT for drivers that actually need it 2023-01-10 11:15:44 +01:00
msm Linux 6.2-rc6 2023-01-31 12:23:23 +01:00
mxsfb drm/mxsfb: improve clk handling for axi clk 2023-01-10 11:04:56 +01:00
nouveau drm/ttm: prevent moving of pinned BOs 2023-02-06 12:10:17 +01:00
omapdrm drm/fb-helper: Initialize fb-helper's preferred BPP in prepare function 2023-01-26 08:52:31 +01:00
panel drm/panel: boe-tv101wum-nl6: Ensure DSI writes succeed during disable 2023-01-31 13:23:38 -08:00
panfrost Linux 6.2-rc6 2023-01-31 12:23:23 +01:00
pl111 drm/fb-helper: Move generic fbdev emulation into separate source file 2022-11-05 17:12:04 +01:00
qxl drm/qxl: stop using ttm_bo_wait 2022-12-19 09:50:06 +01:00
radeon drm/ttm: prevent moving of pinned BOs 2023-02-06 12:10:17 +01:00
rcar-du Renesas R-Car DU fixes and improvements 2023-01-30 13:49:56 +10:00
rockchip drm/rockchip: Drop unbalanced obj unref 2023-02-05 15:32:35 +01:00
scheduler drm/scheduler: deprecate drm_sched_resubmit_jobs 2023-01-18 12:46:52 +01:00
shmobile drm/shmobile: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:32 +01:00
solomon drm/ssd130x: Silence a dubious: x & !y warning 2023-01-24 11:02:33 +01:00
sprd drm/sprd: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:32 +01:00
sti hardening updates for v6.2-rc1 2022-12-14 12:20:00 -08:00
stm drm/fb-helper: Move generic fbdev emulation into separate source file 2022-11-05 17:12:04 +01:00
sun4i drm/sun4i: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:32 +01:00
tegra drm/tegra: Changes for v6.3-rc1 2023-01-30 14:24:52 +10:00
tests drm/format-helper: Use KUNIT_EXPECT_MEMEQ macro 2023-02-02 07:40:15 -03:00
tidss drm/tidss: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:32 +01:00
tilcdc drm: tilcdc: Remove #ifdef guards for PM related functions 2022-12-12 13:07:02 +00:00
tiny drm/simpledrm: Allow physical width and height configuration via panel node 2023-01-31 10:38:59 +01:00
ttm drm/ttm: prevent moving of pinned BOs 2023-02-06 12:10:17 +01:00
tve200 drm/fb-helper: Move generic fbdev emulation into separate source file 2022-11-05 17:12:04 +01:00
udl drm/udl: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:32 +01:00
v3d drm/v3d: replace open-coded implementation of drm_gem_object_lookup 2023-01-03 18:16:01 -01:00
vboxvideo drm/vboxvideo: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:32 +01:00
vc4 Linux 6.2-rc6 2023-01-31 12:23:23 +01:00
vgem drm/vgem: add missing mutex_destroy 2023-02-10 08:21:04 -03:00
virtio Linux 6.2-rc6 2023-01-31 12:23:23 +01:00
vkms drm/vkms: reintroduce prepare_fb and cleanup_fb functions 2023-01-12 09:46:19 -01:00
vmwgfx drm/vmwgfx: Do not drop the reference to the handle too soon 2023-02-14 22:06:19 -05:00
xen xen: branch for v6.2-rc4 2023-01-12 17:02:20 -06:00
xlnx drm-misc-next for 6.2: 2022-11-16 07:17:32 +10:00
drm_agpsupport.c
drm_aperture.c
drm_atomic_helper.c drm/atomic-helper: Add {begin,end}_fb_access to plane helpers 2022-11-08 17:10:27 +01:00
drm_atomic_state_helper.c drm/atomic-helper: fix kernel-doc problems 2023-01-19 09:16:04 +01:00
drm_atomic_uapi.c drm/connector: Add TV standard property 2022-11-24 12:42:39 +01:00
drm_atomic.c drm: use new debugfs device-centered functions on DRM core files 2022-12-22 14:58:21 -03:00
drm_auth.c
drm_blend.c drm/drm_blend: Remove usage of deprecated DRM_DEBUG_ATOMIC 2023-01-10 16:14:13 +01:00
drm_bridge_connector.c drm/bridge_connector: drop drm_bridge_connector_en/disable_hpd() 2023-01-05 15:08:10 +01:00
drm_bridge.c drm/bridge: Document the expected behaviour of DSI host controllers 2022-12-08 09:56:57 +01:00
drm_buddy.c drm: Optimize drm buddy top-down allocation method 2023-01-12 13:50:28 +01:00
drm_bufs.c drm/nouveau: Remove support for legacy contexts/buffers 2023-01-13 09:22:02 +01:00
drm_cache.c
drm_client_modeset.c drm/client: Remove match on mode name 2022-11-24 12:42:40 +01:00
drm_client.c drm/client: Add hotplug_failed flag 2023-01-26 08:52:26 +01:00
drm_color_mgmt.c
drm_connector.c drm/edid: parse VICs from CTA VDB early 2023-01-19 10:53:24 +02:00
drm_context.c drm/nouveau: Remove support for legacy contexts/buffers 2023-01-13 09:22:02 +01:00
drm_crtc_helper_internal.h
drm_crtc_helper.c drm/fb-helper: Remove unnecessary include statements 2022-11-05 17:12:04 +01:00
drm_crtc_internal.h drm/edid: move edid load declarations to internal header 2022-10-26 09:53:56 +03:00
drm_crtc.c
drm_damage_helper.c
drm_debugfs_crc.c
drm_debugfs.c drm/debugfs: use octal permissions instead of symbolic permissions 2023-01-10 09:57:05 -03:00
drm_displayid.c
drm_dma.c
drm_drv.c drm-misc-next for v6.3: 2023-01-04 14:59:25 +01:00
drm_dumb_buffers.c drm: remove dumb_destroy callback 2023-02-10 12:19:27 +01:00
drm_edid_load.c drm/edid/firmware: stop using a throwaway platform device 2022-11-16 14:54:44 +02:00
drm_edid.c drm/edid: remove redundant _drm_connector_update_edid_property() 2023-01-23 11:46:50 +02:00
drm_encoder_slave.c
drm_encoder.c
drm_fb_dma_helper.c
drm_fb_helper.c Linux 6.2-rc6 2023-01-31 12:23:23 +01:00
drm_fbdev_generic.c Linux 6.2-rc6 2023-01-31 12:23:23 +01:00
drm_file.c drm-misc-next for v6.3: 2023-01-16 15:33:28 +10:00
drm_flip_work.c
drm_format_helper.c drm/format-helper: Support the AB24/XB24 formats 2023-01-23 15:02:41 +01:00
drm_fourcc.c drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats 2022-11-23 20:34:46 +01:00
drm_framebuffer.c drm: use new debugfs device-centered functions on DRM core files 2022-12-22 14:58:21 -03:00
drm_gem_atomic_helper.c drm/simple-kms: Remove drm_gem_simple_display_pipe_prepare_fb() 2022-12-05 13:35:37 +01:00
drm_gem_dma_helper.c drm: Remove usage of deprecated DRM_DEBUG_PRIME 2023-01-10 16:14:13 +01:00
drm_gem_framebuffer_helper.c drm/fb-helper: Remove unnecessary include statements 2022-11-05 17:12:04 +01:00
drm_gem_shmem_helper.c drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt() 2023-02-10 13:13:44 +01:00
drm_gem_ttm_helper.c drm/ttm: merge ttm_bo_api.h and ttm_bo_driver.h v2 2022-12-06 12:54:14 +01:00
drm_gem_vram_helper.c drm: use new debugfs device-centered functions on DRM core files 2022-12-22 14:58:21 -03:00
drm_gem.c drm: remove dumb_destroy callback 2023-02-10 12:19:27 +01:00
drm_hashtab.c
drm_internal.h drm: remove dumb_destroy callback 2023-02-10 12:19:27 +01:00
drm_ioc32.c drm: Replace DRM_DEBUG with drm_dbg_core in file and ioctl handling 2023-01-03 18:20:57 +01:00
drm_ioctl.c drm: Replace DRM_DEBUG with drm_dbg_core in file and ioctl handling 2023-01-03 18:20:57 +01:00
drm_irq.c
drm_kms_helper_common.c
drm_lease.c drm: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:30 +01:00
drm_legacy_misc.c
drm_legacy.h
drm_lock.c
drm_managed.c
drm_memory.c
drm_mipi_dbi.c drm/mipi-dbi: Support separate I/O regulator 2022-12-14 14:57:09 +01:00
drm_mipi_dsi.c drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness 2023-01-19 08:21:56 +01:00
drm_mm.c
drm_mode_config.c drm/debugfs: create debugfs late register functions 2022-12-22 14:58:55 -03:00
drm_mode_object.c
drm_modes.c drm: Include <linux/of.h> where needed 2023-01-13 13:18:35 +01:00
drm_modeset_helper.c
drm_modeset_lock.c
drm_of.c drm: of: Add drm_of_get_dsi_bus helper function 2023-01-27 09:39:21 +01:00
drm_panel_orientation_quirks.c Linux 6.2-rc6 2023-01-31 12:23:23 +01:00
drm_panel.c
drm_pci.c
drm_plane_helper.c drm: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:30 +01:00
drm_plane.c drm/docs: Explicitly document default CRTC background behavior 2023-01-04 16:12:15 +00:00
drm_prime.c drm: Assert held reservation lock for dma-buf mmapping 2022-11-11 23:49:47 +03:00
drm_print.c drm_print: add _ddebug descriptor to drm_*dbg prototypes 2022-09-24 15:02:02 +02:00
drm_privacy_screen_x86.c
drm_privacy_screen.c
drm_probe_helper.c drm/probe_helper: sort out poll_running vs poll_enabled 2023-01-26 09:00:40 +01:00
drm_property.c
drm_rect.c gpu/drm: fix repeated words in comments 2022-10-24 09:27:04 +02:00
drm_scatter.c
drm_self_refresh_helper.c
drm_simple_kms_helper.c drm/simple-kms: Remove drm_gem_simple_display_pipe_prepare_fb() 2022-12-05 13:35:37 +01:00
drm_syncobj.c
drm_sysfs.c Driver Core changes for 6.2-rc1 2022-12-16 03:54:54 -08:00
drm_trace_points.c
drm_trace.h
drm_vblank_work.c
drm_vblank.c
drm_vm.c
drm_vma_manager.c drm/drm_vma_manager: Add drm_vma_node_allow_once() 2023-01-19 14:16:55 +01:00
drm_writeback.c
Kconfig drm: Add comments to Kconfig 2023-01-13 09:44:53 +01:00
Makefile drm-misc-next for $kernel-version: 2023-01-24 17:36:29 +01:00