mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-08-23 09:19:51 +00:00
Code Issues Releases Wiki Activity
linux-stable/drivers/gpu/drm/msm
History
Rob Clark d78d383ab3 drm/msm: protect against faults from copy_from_user() in submit ioctl 
An evil userspace could try to cause deadlock by passing an unfaulted-in
GEM bo as submit->bos (or submit->cmds) table.  Which will trigger
msm_gem_fault() while we already hold struct_mutex.  See:

https://github.com/freedreno/msmtest/blob/master/evilsubmittest.c

Cc: stable@vger.kernel.org
Signed-off-by: Rob Clark <robdclark@gmail.com>
2016-08-28 12:49:39 -04:00
..
adreno drm/msm: deal with arbitrary # of cmd buffers 2016-07-16 10:09:08 -04:00
dsi drm/msm/dsi: Fix return value check in msm_dsi_host_set_display_mode() 2016-07-16 10:29:28 -04:00
edp drm: msm: Rely on the default ->best_encoder() behavior where appropriate 2016-06-09 08:43:26 +02:00
hdmi drm/msm/hdmi: Delete an unnecessary check before the function call "kfree" 2016-07-16 10:29:33 -04:00
mdp drm/msm: Delete unnecessary checks before drm_gem_object_unreference_unlocked() 2016-07-16 10:29:34 -04:00
Kconfig drm: msm: Add ASoC generic hdmi audio codec support. 2016-07-16 10:29:00 -04:00
Makefile drm/msm: shrinker support 2016-07-16 10:09:06 -04:00
msm_atomic.c drm/atomic-helper: Massage swap_state signature somewhat 2016-06-10 16:52:12 +02:00
msm_debugfs.c drm/msm: move debugfs code to it's own file 2016-05-08 10:16:02 -04:00
msm_debugfs.h drm/msm: move debugfs code to it's own file 2016-05-08 10:16:02 -04:00
msm_drv.c dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
msm_drv.h drm/msm: protect against faults from copy_from_user() in submit ioctl 2016-08-28 12:49:39 -04:00
msm_fb.c drm/msm: Delete unnecessary checks before drm_gem_object_unreference_unlocked() 2016-07-16 10:29:34 -04:00
msm_fbdev.c drm/msm: change gem->vmap() to get/put 2016-07-16 10:09:07 -04:00
msm_fence.c drm/msm: 'struct fence' conversion 2016-05-08 10:22:15 -04:00
msm_fence.h drm/msm: 'struct fence' conversion 2016-05-08 10:22:15 -04:00
msm_gem.c drm/msm: protect against faults from copy_from_user() in submit ioctl 2016-08-28 12:49:39 -04:00
msm_gem.h drm/msm: deal with arbitrary # of cmd buffers 2016-07-16 10:09:08 -04:00
msm_gem_prime.c drm/msm: change gem->vmap() to get/put 2016-07-16 10:09:07 -04:00
msm_gem_shrinker.c drm/msm: wire up vmap shrinker 2016-07-16 10:09:07 -04:00
msm_gem_submit.c drm/msm: protect against faults from copy_from_user() in submit ioctl 2016-08-28 12:49:39 -04:00
msm_gpu.c drm/msm: print offender task name on hangcheck recovery 2016-05-08 10:22:18 -04:00
msm_gpu.h drm/msm: drop return from gpu->submit() 2016-05-08 10:22:18 -04:00
msm_iommu.c drm/msm: Print the correct virtual addresses in map/unmap funcs 2016-07-16 10:08:44 -04:00
msm_kms.h drm/msm/mdp5: Remove old kms init/destroy funcs 2016-07-16 10:08:57 -04:00
msm_mmu.h drm/msm: make iommu port names const'ier 2016-03-02 16:19:43 -05:00
msm_perf.c drm/msm: return -EFAULT instead of bytes remaining 2016-07-16 10:29:32 -04:00
msm_rd.c drm/msm: return -EFAULT instead of bytes remaining 2016-07-16 10:29:32 -04:00
msm_ringbuffer.c drm/msm: change gem->vmap() to get/put 2016-07-16 10:09:07 -04:00
msm_ringbuffer.h drm/msm: add a3xx gpu support 2013-08-24 14:57:18 -04:00
NOTES drm/msm: add mdp5/apq8x74 2014-01-09 14:44:06 -05:00