openstlinux/linux-st
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
0ea2ea42b31abc1141f2fd3911f952a97d401fcb
linux-st/drivers/gpu/drm
History
Ezequiel Garcia 0ea2ea42b3 drm/vkms: Hold gem object while still in-use 
We need to keep the reference to the drm_gem_object
until the last access by vkms_dumb_create.

Therefore, the put the object after it is used.

This fixes a use-after-free issue reported by syzbot.

While here, change vkms_gem_create() symbol to static.

Reported-and-tested-by: syzbot+e3372a2afe1e7ef04bc7@syzkaller.appspotmail.com
Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200427214405.13069-1-ezequiel@collabora.com
2020-05-06 21:51:46 -04:00
..
amd
drm: Correct DP DSC macro typo
2020-04-30 15:08:58 -04:00
arc
…
arm
drm/komeda: use devm_drm_dev_alloc
2020-04-28 16:04:00 +02:00
armada
drm/<drivers>: Use drmm_add_final_kfree
2020-03-26 15:26:52 +01:00
aspeed
drm/aspeed: Use devm_drm_dev_alloc
2020-04-28 16:13:03 +02:00
ast
drm/ast: remove duplicate assignment of ast_crtc_funcs member
2020-04-30 10:41:05 +02:00
atmel-hlcdc
drm/atmel-hlcdc: Use simple encoder
2020-04-02 14:16:44 +02:00
bochs
drm/bochs: Remove explicit drm_connector_register
2020-04-28 16:14:17 +02:00
bridge
drm/bridge: chrontel-ch7033: Add a new driver
2020-05-05 09:48:56 +02:00
etnaviv
Merge remote-tracking branch 'drm/drm-next' into drm-misc-next
2020-03-26 15:11:04 +01:00
exynos
Merge drm/drm-next into drm-misc-next
2020-04-17 08:12:22 +02:00
fsl-dcu
drm/fsl-dcu: Use simple encoder
2020-04-02 14:16:44 +02:00
gma500
drm/gma500: Remove dead code
2020-04-21 09:02:29 +02:00
hisilicon
drm: kirin: Revert change to add register connect helper functions
2020-04-13 01:46:02 +00:00
i2c
drm/i2c/tda998x: Use simple encoder
2020-04-02 14:16:44 +02:00
i810
…
i915
drm: Nuke mode->hsync
2020-04-29 18:44:26 +03:00
imx
drm/imx: Use simple encoder
2020-04-02 14:16:44 +02:00
ingenic
drm/ingenic: Don't set drm_device->dev_private
2020-04-28 16:03:53 +02:00
lib
…
lima
drm/lima: enable runtime pm
2020-04-24 20:51:24 +08:00
mcde
drm/mcde: Don't use drm_device->dev_private
2020-04-28 16:03:40 +02:00
mediatek
Merge drm/drm-next into drm-misc-next
2020-04-17 08:12:22 +02:00
meson
drm/meson: add mode selection limits against specific SoC revisions
2020-05-05 10:19:33 +02:00
mga
…
mgag200
drm/mgag200: Set up fbdev after registering device; remove error checks
2020-04-08 16:24:52 +02:00
msm
Merge drm/drm-next into drm-misc-next
2020-04-17 08:12:22 +02:00
mxsfb
…
nouveau
Merge drm/drm-next into drm-misc-next
2020-04-17 08:12:22 +02:00
omapdrm
drm/omap: change default signal polarities and drives
2020-05-05 09:58:37 +03:00
panel
drm/panel: add support for rm69299 visionox panel
2020-05-06 20:54:47 +02:00
panfrost
…
pl111
drm: pl111: Move VExpress setup into versatile init
2020-04-28 14:06:20 -05:00
qxl
drm/qxl: Don't use drm_device->dev_private
2020-04-28 20:04:01 +02:00
r128
drm: delete drm_pci.h
2020-04-03 17:11:41 +02:00
radeon
Merge drm/drm-next into drm-misc-next
2020-04-17 08:12:22 +02:00
rcar-du
drm/rcar-du: Use simple encoder
2020-04-02 14:16:45 +02:00
rockchip
drm/rockchip: Remove unneeded semicolon
2020-04-27 21:15:55 +02:00
savage
…
scheduler
drm/scheduler: fix rare NULL ptr race
2020-03-26 10:22:36 -04:00
selftests
…
shmobile
drm/shmobile: Use simple encoder
2020-04-02 14:16:45 +02:00
sis
…
sti
…
stm
drm/stm: ltdc: check number of endpoints
2020-04-27 15:42:12 +02:00
sun4i
drm/sun4i: tcon: Delete an error message in sun4i_tcon_init_irq()
2020-04-06 10:19:25 +02:00
tdfx
…
tegra
drm: Fix misspellings of "Analog Devices"
2020-04-21 08:15:03 +02:00
tidss
drm/tidss: remove AM65x PG1 YUV erratum code
2020-05-05 10:00:07 +03:00
tilcdc
drm/tilcdc: Set up fbdev after fully registering device
2020-04-08 16:24:56 +02:00
tiny
drm/cirrus: Move to drm/tiny
2020-04-28 16:05:15 +02:00
ttm
Merge drm/drm-next into drm-misc-next
2020-04-17 08:12:22 +02:00
tve200
…
udl
drm/udl: Make udl_handle_damage static
2020-05-06 21:08:37 +02:00
v3d
drm/v3d: Delete v3d_dev->pdev
2020-04-28 15:15:59 +02:00
vboxvideo
drm/vboxvideo: Use devm_gen_pool_create
2020-04-28 15:08:51 +02:00
vc4
Merge drm/drm-next into drm-misc-next
2020-04-17 08:12:22 +02:00
vgem
drm: Garbage collect drm_dev_fini
2020-03-26 15:45:36 +01:00
via
…
virtio
drm/virtio: fix OOB in virtio_gpu_object_create
2020-04-06 15:10:37 +02:00
vkms
drm/vkms: Hold gem object while still in-use
2020-05-06 21:51:46 -04:00
vmwgfx
Merge branch 'ttm-transhuge' of git://people.freedesktop.org/~thomash/linux into drm-next
2020-04-03 09:07:49 +10:00
xen
Merge drm/drm-next into drm-misc-next
2020-04-17 08:12:22 +02:00
zte
drm/zte: Use simple encoder
2020-04-02 14:16:46 +02:00
drm_agpsupport.c
…
drm_atomic_helper.c
…
drm_atomic_state_helper.c
…
drm_atomic_uapi.c
…
drm_atomic.c
…
drm_auth.c
drm: error out with EBUSY when device has existing master
2020-03-30 12:20:41 +01:00
drm_blend.c
drm: add docs about the IN_FORMATS plane property
2020-03-31 11:12:42 +02:00
drm_bridge_connector.c
…
drm_bridge.c
…
drm_bufs.c
drm: delete drm_pci.h
2020-04-03 17:11:41 +02:00
drm_cache.c
…
drm_client_modeset.c
…
drm_client.c
…
drm_color_mgmt.c
…
drm_connector.c
…
drm_context.c
…
drm_crtc_helper_internal.h
…
drm_crtc_helper.c
…
drm_crtc_internal.h
…
drm_crtc.c
…
drm_damage_helper.c
…
drm_debugfs_crc.c
…
drm_debugfs.c
…
drm_dma.c
drm: delete drm_pci.h
2020-04-03 17:11:41 +02:00
drm_dp_aux_dev.c
…
drm_dp_cec.c
…
drm_dp_dual_mode_helper.c
…
drm_dp_helper.c
drm/dp: get/set phy compliance pattern
2020-04-08 14:40:42 +02:00
drm_dp_mst_topology_internal.h
…
drm_dp_mst_topology.c
drm/dp_mst: Kill the second sideband tx slot, save the world
2020-04-27 16:18:51 -04:00
drm_drv.c
drm: Add devm_drm_dev_alloc macro
2020-04-28 15:05:19 +02:00
drm_dsc.c
…
drm_dumb_buffers.c
…
drm_edid_load.c
…
drm_edid.c
drm: Nuke mode->hsync
2020-04-29 18:44:26 +03:00
drm_encoder_slave.c
…
drm_encoder.c
…
drm_fb_cma_helper.c
drm: Fix misspellings of "Analog Devices"
2020-04-21 08:15:03 +02:00
drm_fb_helper.c
drm/fb-helper: Remove return value from drm_fbdev_generic_setup()
2020-04-08 16:27:08 +02:00
drm_file.c
drm: make drm_file use keyed wakeups
2020-04-28 17:10:56 +02:00
drm_flip_work.c
…
drm_format_helper.c
…
drm_fourcc.c
…
drm_framebuffer.c
…
drm_gem_cma_helper.c
…
drm_gem_framebuffer_helper.c
drm: Don't free a struct never allocated by drm_gem_fb_init()
2020-04-16 13:44:29 +02:00
drm_gem_shmem_helper.c
…
drm_gem_ttm_helper.c
…
drm_gem_vram_helper.c
drm/vram-helpers: Merge code into a single file
2020-04-09 09:56:33 +02:00
drm_gem.c
drm: Manage drm_gem_init with drmm_
2020-03-26 15:38:09 +01:00
drm_hashtab.c
…
drm_hdcp.c
…
drm_internal.h
drm: Manage drm_vblank_cleanup with drmm_
2020-03-26 15:38:17 +01:00
drm_ioc32.c
…
drm_ioctl.c
drm: rework SET_MASTER and DROP_MASTER perm handling
2020-03-30 12:20:32 +01:00
drm_irq.c
…
drm_kms_helper_common.c
…
drm_lease.c
…
drm_legacy_misc.c
…
drm_legacy.h
…
drm_lock.c
…
drm_managed.c
drm/managed: Fix off-by-one in warning
2020-03-30 21:42:23 +02:00
drm_memory.c
…
drm_mipi_dbi.c
drm/mipi-dbi: Drop explicit drm_mode_config_cleanup call
2020-03-26 16:09:10 +01:00
drm_mipi_dsi.c
…
drm_mm.c
drm/mm: optimize rb_hole_addr rbtree search
2020-05-05 13:39:38 +02:00
drm_mode_config.c
drm: Manage drm_mode_config_init with drmm_
2020-03-26 15:45:43 +01:00
drm_mode_object.c
drm: Replace drm_modeset_lock/unlock_all with DRM_MODESET_LOCK_ALL_* helpers
2020-05-05 10:51:56 +02:00
drm_modes.c
drm: Nuke mode->hsync
2020-04-29 18:44:26 +03:00
drm_modeset_helper.c
…
drm_modeset_lock.c
…
drm_of.c
…
drm_panel_orientation_quirks.c
…
drm_panel.c
…
drm_pci.c
drm: delete drm_pci.h
2020-04-03 17:11:41 +02:00
drm_plane_helper.c
…
drm_plane.c
…
drm_prime.c
drm/prime: fix extracting of the DMA addresses from a scatterlist
2020-04-05 10:44:12 -04:00
drm_print.c
…
drm_probe_helper.c
…
drm_property.c
…
drm_rect.c
…
drm_scatter.c
…
drm_scdc_helper.c
…
drm_self_refresh_helper.c
…
drm_simple_kms_helper.c
…
drm_syncobj.c
…
drm_sysfs.c
…
drm_trace_points.c
…
drm_trace.h
…
drm_vblank.c
drm/vblank: Add intro to documentation
2020-04-07 18:32:42 +02:00
drm_vm.c
…
drm_vma_manager.c
…
drm_writeback.c
…
Kconfig
drm/cirrus: Move to drm/tiny
2020-04-28 16:05:15 +02:00
Makefile
drm/cirrus: Move to drm/tiny
2020-04-28 16:05:15 +02:00