Rob Clark d78d383ab3 drm/msm: protect against faults from copy_from_user() in submit ioctl ...

An evil userspace could try to cause deadlock by passing an unfaulted-in
GEM bo as submit->bos (or submit->cmds) table.  Which will trigger
msm_gem_fault() while we already hold struct_mutex.  See:

https://github.com/freedreno/msmtest/blob/master/evilsubmittest.c

Cc: stable@vger.kernel.org
Signed-off-by: Rob Clark <robdclark@gmail.com>

2016-08-28 12:49:39 -04:00

..

adreno

drm/msm: deal with arbitrary # of cmd buffers

2016-07-16 10:09:08 -04:00

dsi

drm/msm/dsi: Fix return value check in msm_dsi_host_set_display_mode()

2016-07-16 10:29:28 -04:00

edp

drm: msm: Rely on the default ->best_encoder() behavior where appropriate

2016-06-09 08:43:26 +02:00

hdmi

drm/msm/hdmi: Delete an unnecessary check before the function call "kfree"

2016-07-16 10:29:33 -04:00

mdp

drm/msm: Delete unnecessary checks before drm_gem_object_unreference_unlocked()

2016-07-16 10:29:34 -04:00

Kconfig

drm: msm: Add ASoC generic hdmi audio codec support.

2016-07-16 10:29:00 -04:00

Makefile

drm/msm: shrinker support

2016-07-16 10:09:06 -04:00

msm_atomic.c

drm/atomic-helper: Massage swap_state signature somewhat

2016-06-10 16:52:12 +02:00

msm_debugfs.c

drm/msm: move debugfs code to it's own file

2016-05-08 10:16:02 -04:00

msm_debugfs.h

drm/msm: move debugfs code to it's own file

2016-05-08 10:16:02 -04:00

msm_drv.c

dma-mapping: use unsigned long for dma_attrs

2016-08-04 08:50:07 -04:00

msm_drv.h

drm/msm: protect against faults from copy_from_user() in submit ioctl

2016-08-28 12:49:39 -04:00

msm_fb.c

drm/msm: Delete unnecessary checks before drm_gem_object_unreference_unlocked()

2016-07-16 10:29:34 -04:00

msm_fbdev.c

drm/msm: change gem->vmap() to get/put

2016-07-16 10:09:07 -04:00

msm_fence.c

drm/msm: 'struct fence' conversion

2016-05-08 10:22:15 -04:00

msm_fence.h

drm/msm: 'struct fence' conversion

2016-05-08 10:22:15 -04:00

msm_gem_prime.c

drm/msm: change gem->vmap() to get/put

2016-07-16 10:09:07 -04:00

msm_gem_shrinker.c

drm/msm: wire up vmap shrinker

2016-07-16 10:09:07 -04:00

msm_gem_submit.c

drm/msm: protect against faults from copy_from_user() in submit ioctl

2016-08-28 12:49:39 -04:00

msm_gem.c

drm/msm: protect against faults from copy_from_user() in submit ioctl

2016-08-28 12:49:39 -04:00

msm_gem.h

drm/msm: deal with arbitrary # of cmd buffers

2016-07-16 10:09:08 -04:00

msm_gpu.c

drm/msm: print offender task name on hangcheck recovery

2016-05-08 10:22:18 -04:00

msm_gpu.h

drm/msm: drop return from gpu->submit()

2016-05-08 10:22:18 -04:00

msm_iommu.c

drm/msm: Print the correct virtual addresses in map/unmap funcs

2016-07-16 10:08:44 -04:00

msm_kms.h

drm/msm/mdp5: Remove old kms init/destroy funcs

2016-07-16 10:08:57 -04:00

msm_mmu.h

drm/msm: make iommu port names const'ier

2016-03-02 16:19:43 -05:00

msm_perf.c

drm/msm: return -EFAULT instead of bytes remaining

2016-07-16 10:29:32 -04:00

msm_rd.c

drm/msm: return -EFAULT instead of bytes remaining

2016-07-16 10:29:32 -04:00

msm_ringbuffer.c

drm/msm: change gem->vmap() to get/put

2016-07-16 10:09:07 -04:00

msm_ringbuffer.h

drm/msm: add a3xx gpu support

2013-08-24 14:57:18 -04:00

NOTES

drm/msm: add mdp5/apq8x74

2014-01-09 14:44:06 -05:00