1. 08 Dec, 2022 5 commits
  2. 07 Dec, 2022 2 commits
  3. 06 Dec, 2022 10 commits
  4. 05 Dec, 2022 8 commits
  5. 01 Dec, 2022 12 commits
  6. 29 Nov, 2022 3 commits
    • Alaa Emad's avatar
      drm/vkms: change min cursor size to accept smaller values · 7b4668e4
      Alaa Emad authored
      Change min cursor size of vkms driver from 20 to 10, to increase the IGT
      test coverage of vkms by enabling 32x10 cursor size subtests in
      kms_cursor_crc
      Signed-off-by: default avatarAlaa Emad <aemad@igalia.com>
      Reviewed-by: default avatarMelissa Wen <mwen@igalia.com>
      Signed-off-by: default avatarMelissa Wen <melissa.srw@gmail.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20221109113945.20938-1-aemad@igalia.com
      7b4668e4
    • Yuan Can's avatar
      drm/vkms: Fix null-ptr-deref in vkms_release() · 2fe2a8f4
      Yuan Can authored
      A null-ptr-deref is triggered when it tries to destroy the workqueue in
      vkms->output.composer_workq in vkms_release().
      
       KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
       CPU: 5 PID: 17193 Comm: modprobe Not tainted 6.0.0-11331-gd465bff1 #24
       RIP: 0010:destroy_workqueue+0x2f/0x710
       ...
       Call Trace:
        <TASK>
        ? vkms_config_debugfs_init+0x50/0x50 [vkms]
        __devm_drm_dev_alloc+0x15a/0x1c0 [drm]
        vkms_init+0x245/0x1000 [vkms]
        do_one_initcall+0xd0/0x4f0
        do_init_module+0x1a4/0x680
        load_module+0x6249/0x7110
        __do_sys_finit_module+0x140/0x200
        do_syscall_64+0x35/0x80
        entry_SYSCALL_64_after_hwframe+0x46/0xb0
      
      The reason is that an OOM happened which triggers the destroy of the
      workqueue, however, the workqueue is alloced in the later process,
      thus a null-ptr-deref happened. A simple call graph is shown as below:
      
       vkms_init()
        vkms_create()
          devm_drm_dev_alloc()
            __devm_drm_dev_alloc()
              devm_drm_dev_init()
                devm_add_action_or_reset()
                  devm_add_action() # an error happened
                  devm_drm_dev_init_release()
                    drm_dev_put()
                      kref_put()
                        drm_dev_release()
                          vkms_release()
                            destroy_workqueue() # null-ptr-deref happened
          vkms_modeset_init()
            vkms_output_init()
              vkms_crtc_init() # where the workqueue get allocated
      
      Fix this by checking if composer_workq is NULL before passing it to
      the destroy_workqueue() in vkms_release().
      
      Fixes: 6c234fe3 ("drm/vkms: Implement CRC debugfs API")
      Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
      Reviewed-by: default avatarMelissa Wen <mwen@igalia.com>
      Signed-off-by: default avatarMelissa Wen <melissa.srw@gmail.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-3-yuancan@huawei.com
      2fe2a8f4
    • Yuan Can's avatar
      drm/vkms: Fix memory leak in vkms_init() · 0d0b368b
      Yuan Can authored
      A memory leak was reported after the vkms module install failed.
      
      unreferenced object 0xffff88810bc28520 (size 16):
        comm "modprobe", pid 9662, jiffies 4298009455 (age 42.590s)
        hex dump (first 16 bytes):
          01 01 00 64 81 88 ff ff 00 00 dc 0a 81 88 ff ff  ...d............
        backtrace:
          [<00000000e7561ff8>] kmalloc_trace+0x27/0x60
          [<000000000b1954a0>] 0xffffffffc45200a9
          [<00000000abbf1da0>] do_one_initcall+0xd0/0x4f0
          [<000000001505ee87>] do_init_module+0x1a4/0x680
          [<00000000958079ad>] load_module+0x6249/0x7110
          [<00000000117e4696>] __do_sys_finit_module+0x140/0x200
          [<00000000f74b12d2>] do_syscall_64+0x35/0x80
          [<000000008fc6fcde>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
      
      The reason is that the vkms_init() returns without checking the return
      value of vkms_create(), and if the vkms_create() failed, the config
      allocated at the beginning of vkms_init() is leaked.
      
       vkms_init()
         config = kmalloc(...) # config allocated
         ...
         return vkms_create() # vkms_create failed and config is leaked
      
      Fix this problem by checking return value of vkms_create() and free the
      config if error happened.
      
      Fixes: 2df7af93 ("drm/vkms: Add vkms_config type")
      Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
      Reviewed-by: default avatarMelissa Wen <mwen@igalia.com>
      Signed-off-by: default avatarMelissa Wen <melissa.srw@gmail.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-2-yuancan@huawei.com
      0d0b368b