[PATCH v3] drm/i915: bounds check execbuffer relocation count

It is possible to wrap the counter used to allocate the buffer for relocation copies. This could lead to heap writing overflows. CVE-2013-0913 v3: collapse test, improve comment v2: move check into validate_exec_list Signed-off-by: Kees Cook Reported-by: Pinkie Pie Cc: sta...@vger.kernel.org --

Re: [PATCH] drm/i915: use simple attribute in debugfs routines

On Mon, Mar 11, 2013 at 4:03 PM, Daniel Vetter wrote: > On Sun, Mar 10, 2013 at 02:10:06PM -0700, Kees Cook wrote: >> This replaces the manual read/write routines in debugfs with the common >> simple attribute helpers. Doing this gets rid of repeated copy/pasting >> of copy_from_user and value for

Re: [PATCH] drivers/gpu/drm/tilcdc: Makefile, only -Werror when no -W* in EXTRA_CFLAGS

于 2013年03月11日 22:02, Rob Clark 写道: > On Sun, Mar 10, 2013 at 12:04 AM, Chen Gang wrote: >> > >> > When make with EXTRA_CFLAGS=-W, it will report error. >> > so give a check in Makefile. >> > >> > Signed-off-by: Chen Gang >> > Signed-off-by: Vladimir Kondratiev > Signed-off-by: Rob Clark >

Re: [PATCH REPOST] drm: tegra: don't depend on OF

On Mon, Mar 11, 2013 at 04:33:02PM -0600, Stephen Warren wrote: > From: Stephen Warren > > ARCH_TEGRA always enabled OF, so there's no need for any driver to > depend on it. > > Signed-off-by: Stephen Warren > --- > drivers/gpu/drm/tegra/Kconfig |2 +- > 1 file changed, 1 insertion(+), 1 d

[PATCH] gpu: don't cast kzalloc() return value

On Sun, Mar 10, 2013 at 02:22:48PM +0200, Mihnea Dobrescu-Balaur wrote: > Signed-off-by: Mihnea Dobrescu-Balaur Queued for -next, thanks for the patch. -Daniel -- Daniel Vetter Software Engineer, Intel Corporation +41 (0) 79 365 57 48 - http://blog.ffwll.ch

Re: sub function power management (gpu + audio device)

At Tue, 12 Mar 2013 16:05:26 +1000, Dave Airlie wrote: > > Hey guys, > > I've been writing dynamic power management code for the secondary > GPUs, however a lot of these GPUs have audio codecs as a subfunction > PCI device. > > So we get 01:00.0 as the GPU and 01:00.1 as the HDMI audio device. >

[PATCH 01/14] x86, ACPI, mm: Kill max_low_pfn_mapped

On Thu, Mar 07, 2013 at 10:09:26PM -0800, H. Peter Anvin wrote: > On 03/07/2013 09:28 PM, Tejun Heo wrote: > > On Thu, Mar 7, 2013 at 9:27 PM, Yinghai Lu wrote: > >> They are not using memblock_find_in_range(), so 1ULL<< will not help. > >> > >> Really hope i915 drm guys could clean that hacks. >

[Bug 57919] Visual glitches in unity with Radeon HD 7600M

You are the assignee for the bug. -- next part -- An HTML attachment was scrubbed... URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/3c8db69a/attachment.html>

[git pull] drm nouveau fixes

Hi Linus, this is just nouveau fixes from Ben, one fixes a nasty oops that some Fedora people have been seeing, so I'd like to get it out of the way. Dave. The following changes since commit f6161aa153581da4a3867a2d1a7caf4be19b6ec9: Linux 3.9-rc2 (2013-03-10 16:54:19 -0700) are available i

Re: [PATCH 4/4] omapdss: features: fixed supported outputs for OMAP4

On Monday 11 March 2013 05:58 PM, Tomi Valkeinen wrote: On 2013-03-05 16:17, Archit Taneja wrote: The support outputs struct for overlay managers is incorrect for OMAP4. Make these changes: - DPI isn't supported via the LCD1 overlay manager, remove DPI as a supported output. - the TV manager

[PATCH 01/14] x86, ACPI, mm: Kill max_low_pfn_mapped

On Mon, Mar 11, 2013 at 11:50:48PM +0100, Daniel Vetter wrote: > On Thu, Mar 07, 2013 at 10:09:26PM -0800, H. Peter Anvin wrote: > > On 03/07/2013 09:28 PM, Tejun Heo wrote: > > > On Thu, Mar 7, 2013 at 9:27 PM, Yinghai Lu wrote: > > >> They are not using memblock_find_in_range(), so 1ULL<< will n

sub function power management (gpu + audio device)

Hey guys, I've been writing dynamic power management code for the secondary GPUs, however a lot of these GPUs have audio codecs as a subfunction PCI device. So we get 01:00.0 as the GPU and 01:00.1 as the HDMI audio device. Now we have a single power switch for these devices, and generally the p

[PATCH v2] drm/i915: bounds check execbuffer relocation count

On Mon, Mar 11, 2013 at 03:25:59PM -0700, Kees Cook wrote: > On Mon, Mar 11, 2013 at 3:00 PM, Chris Wilson > wrote: > > On Mon, Mar 11, 2013 at 02:23:29PM -0700, Kees Cook wrote: > >> It is possible to wrap the counter used to allocate the buffer for > >> relocation copies. This could lead to hea

linux-next: build failure after merge of the final tree (drm-intel tree related)

On Mon, Mar 11, 2013 at 9:22 PM, Stephen Rothwell wrote: > Hi all, > > After merging the final tree, today's linux-next build (i386 defconfig) > failed like this: > > drivers/built-in.o: In function `i915_min_freq_set': > i915_debugfs.c:(.text+0xb1adc): undefined reference to `__udivdi3' > driver

[PATCH] drm/i915: use do_div() as needed in debugfs code

This replaces the open-coded divisions in the debugfs code by calls to do_div(). Signed-off-by: Kees Cook Cc: Daniel Vetter --- drivers/gpu/drm/i915/i915_debugfs.c | 12 ++-- 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/g

[PATCH] drivers: gpu: drm: i915: Replaced calls to kmalloc & memcpy with kmemdup

Replaced calls to kmalloc followed by memcpy with a single call to kmemdup. Also removed a now redundant if statement. Signed-off-by: Alexandru Gheorghiu --- drivers/gpu/drm/i915/intel_dp.c |5 + 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/gpu/drm/i915/intel_dp.c

[PATCH V3] get_maintainer: use filename-only regex match for Tegra

> @@ -611,7 +611,7 @@ sub get_maintainers { > $hash{$tvi} = $value_pd; > } > } > - } elsif ($type eq 'K') { > + } elsif ($type eq 'N')

[PATCH] drivers: gpu: drm: i915: Replaced calls to kmalloc & memcpy with kmemdup

at suggests an obvious further cleanup that coccinelle could easily > handle: > > if (!foo) > return NULL; > return foo; > > should become just "return foo;". And you might then want to check for > variables used *only* to capture a return value and immediately > returned, and eliminate them. > > - Josh Triplett > -- next part -- An HTML attachment was scrubbed... URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/c7c8a1a0/attachment.html>

[PATCH] drivers: gpu: drm: gma500: Replaced calls kzalloc & memcpy with kmemdup

On Mon, Mar 11, 2013 at 8:46 PM, Alexandru Gheorghiu wrote: > Replaced calls kzalloc followed by memcpy with call to kmemdup. > Patch found using coccinelle. > > Signed-off-by: Alexandru Gheorghiu > --- > drivers/gpu/drm/gma500/intel_bios.c |3 +-- > 1 file changed, 1 insertion(+), 2 deletio

[PATCH v2] drm/i915: bounds check execbuffer relocation count

On Mon, Mar 11, 2013 at 02:23:29PM -0700, Kees Cook wrote: > It is possible to wrap the counter used to allocate the buffer for > relocation copies. This could lead to heap writing overflows. I'd keep the return value as EINVAL so that we can continue to distinguish between the user passing garbag

[Bug 60439] Suspend/resume broken for cayman with 90a51a329258e3c868f6

You are the assignee for the bug. -- next part -- An HTML attachment was scrubbed... URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/8549f06b/attachment.html>

[PATCH] drivers: gpu: drm: gma500: Replaced calls kzalloc & memcpy with kmemdup

Replaced calls kzalloc followed by memcpy with call to kmemdup. Patch found using coccinelle. Signed-off-by: Alexandru Gheorghiu --- drivers/gpu/drm/gma500/intel_bios.c |3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/gpu/drm/gma500/intel_bios.c b/drivers/gpu/drm

[PATCH] drivers: gpu: drm: Replaced ERR_PTR & PTR_ERR with ERR_CAST

Replaced ERR_PTR and PTR_ERR calls with ERR_CAST. Patch found using coccinelle. Signed-off-by: Alexandru Gheorghiu --- drivers/gpu/drm/drm_prime.c |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index 366910d..4c8ad

[PATCH] drivers: gpu: drm: i915: Replaced calls to kmalloc & memcpy with kmemdup

Replaced calls to kmalloc followed by memcpy with a single call to kmemdup. This patch was found using coccinelle. Signed-off-by: Alexandru Gheorghiu --- drivers/gpu/drm/i915/intel_dp.c |3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/gpu/drm/i915/intel_dp.c b/dri

[PATCH] drivers: gpu: drm: exynos: Replaced kzalloc & memcpy with kmemdup

Replaced calls to kzalloc followed by memcpy with call to kmemdup. Patch found using coccinelle. Signed-off-by: Alexandru Gheorghiu --- drivers/gpu/drm/exynos/exynos_drm_vidi.c |6 ++ 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c

linux-next: build failure after merge of the final tree (drm-intel tree related)

Hi all, After merging the final tree, today's linux-next build (i386 defconfig) failed like this: drivers/built-in.o: In function `i915_min_freq_set': i915_debugfs.c:(.text+0xb1adc): undefined reference to `__udivdi3' drivers/built-in.o: In function `i915_max_freq_set': i915_debugfs.c:(.text+0xb1

Re: [PATCH] drivers: gpu: drm: exynos: Replaced kzalloc & memcpy with kmemdup

Applied. Thanks, Inki Dae 2013/3/12 Alexandru Gheorghiu : > Replaced calls to kzalloc followed by memcpy with call to kmemdup. > Patch found using coccinelle. > > Signed-off-by: Alexandru Gheorghiu > --- > drivers/gpu/drm/exynos/exynos_drm_vidi.c |6 ++ > 1 file changed, 2 insertions(+)

[PATCH] drm/i915: clarify reasoning for the access_ok call

On Mon, Mar 11, 2013 at 02:04:51PM -0700, Kees Cook wrote: > Probably not. It just seemed like the existing comment was > insufficient after the removal of the redundant VERIFY_READ check that > happened recently. That's certainly true, the remaining comment is a little cryptic. Something more lik

[PATCH] drm/i915: bounds check execbuffer relocations

On Mon, Mar 11, 2013 at 12:27:16PM -0700, Kees Cook wrote: > It is possible to wrap the counter used to allocate the buffer for > relocation copies. This could lead to heap writing overflows. Seems a sensible check, just in the wrong location. You need to do the checking upfront in validate_exec_l

[PATCH] drm/i915: clarify reasoning for the access_ok call

On Mon, Mar 11, 2013 at 12:26:30PM -0700, Kees Cook wrote: > This clarifies the comment above the access_ok check so a missing > VERIFY_READ doesn't alarm anyone. Do we really need to copy the interface documentation? /** * access_ok: - Checks if a user space pointer is valid * @type: Type of a

[Bug 57919] Visual glitches in unity with Radeon HD 7600M

rom the livecd of 03/11/13 of ubuntu raring ringtail. -- You are receiving this mail because: You are the assignee for the bug. -- next part -- An HTML attachment was scrubbed... URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/2882f9ab/attachment.html>

[Bug 57919] Visual glitches in unity with Radeon HD 7600M

https://bugs.freedesktop.org/show_bug.cgi?id=57919 --- Comment #4 from Thilo Cestonaro --- Tried with cdimage: http://cdimages.ubuntu.com/daily-live/20130311/raring-desktop-amd64.iso Still very ugly glitches! Please, if I can provide any more details or something, tell me! I added a glxinfo

[Bug 60439] Suspend/resume broken for cayman with 90a51a329258e3c868f6

ssignee for the bug. -- next part -- An HTML attachment was scrubbed... URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/11f37e7d/attachment.html>

[PATCH] drm/radeon: fix backend map setup on 1 RB trinity boards

From: Alex Deucher Need to adjust the backend map depending on which RB is enabled. This is the trinity equivalent of: f7eb97300832f4fe5fe916c5d84cd2e25169330e Signed-off-by: Alex Deucher Cc: stable at vger.kernel.org --- drivers/gpu/drm/radeon/ni.c | 21 - 1 files chang

Re: [PATCH] drivers: gpu: drm: exynos: Replaced kzalloc & memcpy with kmemdup

Good point. Acked-by: Seung-Woo Kim On 2013년 03월 12일 04:25, Alexandru Gheorghiu wrote: > Replaced calls to kzalloc followed by memcpy with call to kmemdup. > Patch found using coccinelle. > > Signed-off-by: Alexandru Gheorghiu > --- > drivers/gpu/drm/exynos/exynos_drm_vidi.c |6 ++ >

Re: [PATCH 01/14] x86, ACPI, mm: Kill max_low_pfn_mapped

The problem is that the code will be broken, and so it makes no sense. The #if 0 is really confusing. Daniel Vetter wrote: >On Thu, Mar 07, 2013 at 10:09:26PM -0800, H. Peter Anvin wrote: >> On 03/07/2013 09:28 PM, Tejun Heo wrote: >> > On Thu, Mar 7, 2013 at 9:27 PM, Yinghai Lu >wrote: >> >>

[PATCH 01/14] x86, ACPI, mm: Kill max_low_pfn_mapped

The problem is that the code will be broken, and so it makes no sense. The #if 0 is really confusing. Daniel Vetter wrote: >On Thu, Mar 07, 2013 at 10:09:26PM -0800, H. Peter Anvin wrote: >> On 03/07/2013 09:28 PM, Tejun Heo wrote: >> > On Thu, Mar 7, 2013 at 9:27 PM, Yinghai Lu >wrote: >> >>

[Bug 62170] [bisected] R600 LLVM build broken

vel/attachments/20130311/ea26ec50/attachment.html>

[PATCH v3] drm/i915: bounds check execbuffer relocation count

It is possible to wrap the counter used to allocate the buffer for relocation copies. This could lead to heap writing overflows. CVE-2013-0913 v3: collapse test, improve comment v2: move check into validate_exec_list Signed-off-by: Kees Cook Reported-by: Pinkie Pie Cc: stable at vger.kernel.org

[PATCH] drm/i915: use simple attribute in debugfs routines

On Mon, Mar 11, 2013 at 4:03 PM, Daniel Vetter wrote: > On Sun, Mar 10, 2013 at 02:10:06PM -0700, Kees Cook wrote: >> This replaces the manual read/write routines in debugfs with the common >> simple attribute helpers. Doing this gets rid of repeated copy/pasting >> of copy_from_user and value for

[PATCH 2/2] drm/radeon: tear down the IB pool on suspend

From: Alex Deucher Otherwise we may end up with stale MC addresses after resume. Signed-off-by: Alex Deucher Cc: stable at vger.kernel.org --- drivers/gpu/drm/radeon/evergreen.c |1 + drivers/gpu/drm/radeon/ni.c|1 + drivers/gpu/drm/radeon/r100.c |1 + drivers/gpu/drm/

[PATCH 1/2] drm/radeon: fix S/R on VM systems (cayman/TN/SI)

From: Alex Deucher We weren't properly tearing down the VM sub-alloctor on suspend leading to bogus VM PTs on resume. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=60439 Tested-by: Dmitry Cherkasov Signed-off-by: Alex Deucher Cc: stable at vger.kernel.org --- drivers/gpu/drm/radeon/ni.

[PATCH 0/2] Properly suspend/resume sub-allocator

From: Alex Deucher This patch set is a bit of a heavy hammer, but I'm not sure it's worth the effort to create separate suspend functions for all sub-allocator users that basically just calls radeon_sa_bo_manager_suspend() and fix up all the sub allocator init functions to call radeon_sa_bo_manag

[Bug 57919] Visual glitches in unity with Radeon HD 7600M

https://bugs.freedesktop.org/show_bug.cgi?id=57919 --- Comment #6 from Alex Deucher --- Created attachment 76354 --> https://bugs.freedesktop.org/attachment.cgi?id=76354&action=edit possible fix Does the attached kernel patch fix the issue? -- You are receiving this mail because: You are the

[PATCH REPOST] drm: tegra: don't depend on OF

From: Stephen Warren ARCH_TEGRA always enabled OF, so there's no need for any driver to depend on it. Signed-off-by: Stephen Warren --- drivers/gpu/drm/tegra/Kconfig |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/tegra/Kconfig b/drivers/gpu/drm/tegra/Kco

[PATCH] drm/radeon: fix backend map setup on 1 RB trinity boards

From: Alex Deucher Need to adjust the backend map depending on which RB is enabled. This is the trinity equivalent of: f7eb97300832f4fe5fe916c5d84cd2e25169330e Signed-off-by: Alex Deucher Cc: sta...@vger.kernel.org --- drivers/gpu/drm/radeon/ni.c | 21 - 1 files changed,

Re: [PATCH] drm/i915: restrict kernel address leak in debugfs

On Mon, Mar 11, 2013 at 12:25:19PM -0700, Kees Cook wrote: > Masks kernel address info-leak in object dumps with the %pK suffix, > so they cannot be used to target kernel memory corruption attacks if > the kptr_restrict sysctl is set. > > Signed-off-by: Kees Cook > Cc: sta...@vger.kernel.org Pick

Re: [PATCH v2] drm/i915: clarify reasoning for the access_ok call

On Mon, Mar 11, 2013 at 02:37:35PM -0700, Kees Cook wrote: > This clarifies the comment above the access_ok check so a missing > VERIFY_READ doesn't alarm anyone. > > Signed-off-by: Kees Cook > Cc: Daniel Vetter > --- > v2: > - rewrote comment, thanks to Chris Wilson Queued for -next, thanks f

Re: [PATCH 01/14] x86, ACPI, mm: Kill max_low_pfn_mapped

On Mon, Mar 11, 2013 at 11:50:48PM +0100, Daniel Vetter wrote: > On Thu, Mar 07, 2013 at 10:09:26PM -0800, H. Peter Anvin wrote: > > On 03/07/2013 09:28 PM, Tejun Heo wrote: > > > On Thu, Mar 7, 2013 at 9:27 PM, Yinghai Lu wrote: > > >> They are not using memblock_find_in_range(), so 1ULL<< will n

Re: [PATCH] drm/i915: use simple attribute in debugfs routines

On Sun, Mar 10, 2013 at 02:10:06PM -0700, Kees Cook wrote: > This replaces the manual read/write routines in debugfs with the common > simple attribute helpers. Doing this gets rid of repeated copy/pasting > of copy_from_user and value formatting code. > > Signed-off-by: Kees Cook > Cc: Daniel Ve

Re: nouveau shuts the machine down with v3.9-rc1 (temperature (72 C) hit the 'shutdown' threshold).

On 11/03/2013 13:38, Konrad Rzeszutek Wilk wrote: With that I am still getting the issues (even with an insance delay of 100 seconds). Here is the serial log with various runs. Any thoughts? Sorry for taking so long to answer but I got a one-week flu and still had to do my research duties :s

Re: [PATCH] gpu: don't cast kzalloc() return value

On Sun, Mar 10, 2013 at 02:22:48PM +0200, Mihnea Dobrescu-Balaur wrote: > Signed-off-by: Mihnea Dobrescu-Balaur Queued for -next, thanks for the patch. -Daniel -- Daniel Vetter Software Engineer, Intel Corporation +41 (0) 79 365 57 48 - http://blog.ffwll.ch __

[PATCH V3] get_maintainer: use filename-only regex match for Tegra

On 03/11/2013 03:36 PM, Marcin ?lusarz wrote: > > 11 mar 2013 21:19, "Stephen Warren" > napisa?(a): >> Create a new N: entry type in MAINTAINERS which performs a regex match >> against filenames; either those extracted from patch +++ or --- lines, >> or those spec

Re: [PATCH v2] drm/i915: bounds check execbuffer relocation count

On Mon, Mar 11, 2013 at 03:25:59PM -0700, Kees Cook wrote: > On Mon, Mar 11, 2013 at 3:00 PM, Chris Wilson > wrote: > > On Mon, Mar 11, 2013 at 02:23:29PM -0700, Kees Cook wrote: > >> It is possible to wrap the counter used to allocate the buffer for > >> relocation copies. This could lead to hea

Re: [PATCH 01/14] x86, ACPI, mm: Kill max_low_pfn_mapped

On Thu, Mar 07, 2013 at 10:09:26PM -0800, H. Peter Anvin wrote: > On 03/07/2013 09:28 PM, Tejun Heo wrote: > > On Thu, Mar 7, 2013 at 9:27 PM, Yinghai Lu wrote: > >> They are not using memblock_find_in_range(), so 1ULL<< will not help. > >> > >> Really hope i915 drm guys could clean that hacks. >

[Bug 58372] [KMS][Cayman] Garbled screen and gpu crash with 6950 with drm-next

org/archives/dri-devel/attachments/20130311/b1ade6c8/attachment.html>

Re: [PATCH v2] drm/i915: bounds check execbuffer relocation count

On Mon, Mar 11, 2013 at 3:00 PM, Chris Wilson wrote: > On Mon, Mar 11, 2013 at 02:23:29PM -0700, Kees Cook wrote: >> It is possible to wrap the counter used to allocate the buffer for >> relocation copies. This could lead to heap writing overflows. > > I'd keep the return value as EINVAL so that w

[PATCH v2] drm/i915: clarify reasoning for the access_ok call

This clarifies the comment above the access_ok check so a missing VERIFY_READ doesn't alarm anyone. Signed-off-by: Kees Cook Cc: Daniel Vetter --- v2: - rewrote comment, thanks to Chris Wilson --- drivers/gpu/drm/i915/i915_gem_execbuffer.c |6 +- 1 file changed, 5 insertions(+), 1 dele

[PATCH v2] drm/i915: bounds check execbuffer relocation count

It is possible to wrap the counter used to allocate the buffer for relocation copies. This could lead to heap writing overflows. Signed-off-by: Kees Cook Reported-by: Pinkie Pie Cc: sta...@vger.kernel.org --- v2: - move check into validate_exec_list --- drivers/gpu/drm/i915/i915_gem_execbuffer.

[PATCH 1/4] drm/tilcdc: Fix an incorrect condition

Hi Rob, On 2 March 2013 20:40, Rob Clark wrote: > On Sat, Mar 2, 2013 at 5:23 AM, Sachin Kamat > wrote: >> Instead of checking if num_encoders is zero, it is being assigned 0. >> Convert the assignment to a check. >> >> Signed-off-by: Sachin Kamat > > Signed-off-by: Rob Clark Just curious. W

[PATCH REPOST] drm: tegra: don't depend on OF

From: Stephen Warren ARCH_TEGRA always enabled OF, so there's no need for any driver to depend on it. Signed-off-by: Stephen Warren --- drivers/gpu/drm/tegra/Kconfig |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/tegra/Kconfig b/drivers/gpu/drm/tegra/Kco

[PATCH v2] drm/i915: bounds check execbuffer relocation count

On Mon, Mar 11, 2013 at 3:00 PM, Chris Wilson wrote: > On Mon, Mar 11, 2013 at 02:23:29PM -0700, Kees Cook wrote: >> It is possible to wrap the counter used to allocate the buffer for >> relocation copies. This could lead to heap writing overflows. > > I'd keep the return value as EINVAL so that

nouveau lockdep splat

On 03/07/13 12:20, Arend van Spriel wrote: > On 03/04/13 22:16, Borislav Petkov wrote: >> New -rc1, so let the stabilization games begin. >> >> I see the following on rc1, let me know if you need more info. >> >> >> [ 0.633617] = >> [ 0.633618] [ INFO: po

Re: [PATCH V3] get_maintainer: use filename-only regex match for Tegra

On 03/11/2013 03:36 PM, Marcin Ślusarz wrote: > > 11 mar 2013 21:19, "Stephen Warren" > napisał(a): >> Create a new N: entry type in MAINTAINERS which performs a regex match >> against filenames; either those extracted from patch +++ or --- lines, >> or those specifi

[Bug 60439] Suspend/resume broken for cayman with 90a51a329258e3c868f6

't trigger the bug. However, doing the same under KDE or Gnome-Shell does exhibit it. -- You are receiving this mail because: You are the assignee for the bug. -- next part -- An HTML attachment was scrubbed... URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/f39861c1/attachment.html>

Re: [PATCH v2] drm/i915: bounds check execbuffer relocation count

On Mon, Mar 11, 2013 at 02:23:29PM -0700, Kees Cook wrote: > It is possible to wrap the counter used to allocate the buffer for > relocation copies. This could lead to heap writing overflows. I'd keep the return value as EINVAL so that we can continue to distinguish between the user passing garbag

[Bug 60439] Suspend/resume broken for cayman with 90a51a329258e3c868f6

RL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/9b6c5335/attachment.html>

[Bug 62170] [bisected] R600 LLVM build broken

t was scrubbed... URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/f1b3d572/attachment.html>

[Bug 60439] Suspend/resume broken for cayman with 90a51a329258e3c868f6

https://bugs.freedesktop.org/show_bug.cgi?id=60439 --- Comment #14 from Alexandre Demers --- (In reply to comment #13) > Created attachment 76349 [details] [review] > possible fix > > This patch should fix the issue. It does over here. -- You are receiving this mail because: You are the assig

[Bug 60553] [trine2] wrong colors when executed fullscreen

are receiving this mail because: You are the assignee for the bug. -- next part -- An HTML attachment was scrubbed... URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/11afe4dc/attachment.html>

[Bug 62170] New: [bisected] R600 LLVM build broken

3d80a736c M src -- You are receiving this mail because: You are the assignee for the bug. -- next part -- An HTML attachment was scrubbed... URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/22be693b/attachment.html>

Re: [PATCH V3] get_maintainer: use filename-only regex match for Tegra

11 mar 2013 21:19, "Stephen Warren" napisał(a): > > From: Stephen Warren > > Create a new N: entry type in MAINTAINERS which performs a regex match > against filenames; either those extracted from patch +++ or --- lines, > or those specified on the command-line using the -f option. > > This provi

[PATCH v2] drm/i915: clarify reasoning for the access_ok call

This clarifies the comment above the access_ok check so a missing VERIFY_READ doesn't alarm anyone. Signed-off-by: Kees Cook Cc: Daniel Vetter --- v2: - rewrote comment, thanks to Chris Wilson --- drivers/gpu/drm/i915/i915_gem_execbuffer.c |6 +- 1 file changed, 5 insertions(+), 1 dele

[PATCH 4/4] omapdss: features: fixed supported outputs for OMAP4

e: application/pgp-signature Size: 899 bytes Desc: OpenPGP digital signature URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/4a9ea618/attachment-0001.pgp>

[PATCH v2] drm/i915: bounds check execbuffer relocation count

It is possible to wrap the counter used to allocate the buffer for relocation copies. This could lead to heap writing overflows. Signed-off-by: Kees Cook Reported-by: Pinkie Pie Cc: stable at vger.kernel.org --- v2: - move check into validate_exec_list --- drivers/gpu/drm/i915/i915_gem_execbuff

Re: [PATCH] drivers: gpu: drm: i915: Replaced calls to kmalloc & memcpy with kmemdup

On Mon, 2013-03-11 at 22:39 +0200, Alexandru Gheorghiu wrote: > Replaced calls to kmalloc followed by memcpy with a single call to kmemdup. > Also removed a now redundant if statement. [] > diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c [] > @@ -2335,11 +2335,8 @@ in

Re: [PATCH] drm/i915: clarify reasoning for the access_ok call

On Mon, Mar 11, 2013 at 02:04:51PM -0700, Kees Cook wrote: > Probably not. It just seemed like the existing comment was > insufficient after the removal of the redundant VERIFY_READ check that > happened recently. That's certainly true, the remaining comment is a little cryptic. Something more lik

[PATCH] drivers: gpu: drm: i915: Replaced calls to kmalloc & memcpy with kmemdup

On Mon, 2013-03-11 at 22:39 +0200, Alexandru Gheorghiu wrote: > Replaced calls to kmalloc followed by memcpy with a single call to kmemdup. > Also removed a now redundant if statement. [] > diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c [] > @@ -2335,11 +2335,8 @@ in

[PATCH V3] get_maintainer: use filename-only regex match for Tegra

From: Stephen Warren Create a new N: entry type in MAINTAINERS which performs a regex match against filenames; either those extracted from patch +++ or --- lines, or those specified on the command-line using the -f option. This provides the same benefits as using a K: regex option to match a set

Re: [PATCH] drivers: gpu: drm: i915: Replaced calls to kmalloc & memcpy with kmemdup

On Mon, Mar 11, 2013 at 09:30:40PM +0200, Alexandru Gheorghiu wrote: > Replaced calls to kmalloc followed by memcpy with a single call to kmemdup. > This patch was found using coccinelle. > > Signed-off-by: Alexandru Gheorghiu > --- > drivers/gpu/drm/i915/intel_dp.c |3 +-- > 1 file changed,

Re: [PATCH] drm/i915: bounds check execbuffer relocations

On Mon, Mar 11, 2013 at 1:52 PM, Chris Wilson wrote: > On Mon, Mar 11, 2013 at 12:27:16PM -0700, Kees Cook wrote: >> It is possible to wrap the counter used to allocate the buffer for >> relocation copies. This could lead to heap writing overflows. > > Seems a sensible check, just in the wrong loc

Re: [PATCH] drm/i915: clarify reasoning for the access_ok call

On Mon, Mar 11, 2013 at 1:51 PM, Chris Wilson wrote: > On Mon, Mar 11, 2013 at 12:26:30PM -0700, Kees Cook wrote: >> This clarifies the comment above the access_ok check so a missing >> VERIFY_READ doesn't alarm anyone. > > Do we really need to copy the interface documentation? > > /** > * access

[PATCH] drivers: gpu: drm: i915: Replaced calls to kmalloc & memcpy with kmemdup

Replaced calls to kmalloc followed by memcpy with a single call to kmemdup. Also removed a now redundant if statement. Signed-off-by: Alexandru Gheorghiu --- drivers/gpu/drm/i915/intel_dp.c |5 + 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/gpu/drm/i915/intel_dp.c

Re: [PATCH] drivers: gpu: drm: i915: Replaced calls to kmalloc & memcpy with kmemdup

You are right. I shall resend :) Thanks! On Mon, Mar 11, 2013 at 10:25 PM, Josh Triplett wrote: > On Mon, Mar 11, 2013 at 09:30:40PM +0200, Alexandru Gheorghiu wrote: > > Replaced calls to kmalloc followed by memcpy with a single call to > kmemdup. > > This patch was found using coccinelle. > >

[Bug 60439] Suspend/resume broken for cayman with 90a51a329258e3c868f6

ttp://lists.freedesktop.org/archives/dri-devel/attachments/20130311/dd35aa79/attachment-0001.html>

[PATCH 2/2] drm/radeon: tear down the IB pool on suspend

From: Alex Deucher Otherwise we may end up with stale MC addresses after resume. Signed-off-by: Alex Deucher Cc: sta...@vger.kernel.org --- drivers/gpu/drm/radeon/evergreen.c |1 + drivers/gpu/drm/radeon/ni.c|1 + drivers/gpu/drm/radeon/r100.c |1 + drivers/gpu/drm/rad

[PATCH] drm/i915: bounds check execbuffer relocations

On Mon, Mar 11, 2013 at 1:52 PM, Chris Wilson wrote: > On Mon, Mar 11, 2013 at 12:27:16PM -0700, Kees Cook wrote: >> It is possible to wrap the counter used to allocate the buffer for >> relocation copies. This could lead to heap writing overflows. > > Seems a sensible check, just in the wrong lo

[PATCH 1/2] drm/radeon: fix S/R on VM systems (cayman/TN/SI)

From: Alex Deucher We weren't properly tearing down the VM sub-alloctor on suspend leading to bogus VM PTs on resume. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=60439 Tested-by: Dmitry Cherkasov Signed-off-by: Alex Deucher Cc: sta...@vger.kernel.org --- drivers/gpu/drm/radeon/ni.c |

[PATCH 0/2] Properly suspend/resume sub-allocator

From: Alex Deucher This patch set is a bit of a heavy hammer, but I'm not sure it's worth the effort to create separate suspend functions for all sub-allocator users that basically just calls radeon_sa_bo_manager_suspend() and fix up all the sub allocator init functions to call radeon_sa_bo_manag

[PATCH] drm/i915: clarify reasoning for the access_ok call

On Mon, Mar 11, 2013 at 1:51 PM, Chris Wilson wrote: > On Mon, Mar 11, 2013 at 12:26:30PM -0700, Kees Cook wrote: >> This clarifies the comment above the access_ok check so a missing >> VERIFY_READ doesn't alarm anyone. > > Do we really need to copy the interface documentation? > > /** > * acces

Re: [PATCH] drivers: gpu: drm: gma500: Replaced calls kzalloc & memcpy with kmemdup

On Mon, Mar 11, 2013 at 8:46 PM, Alexandru Gheorghiu wrote: > Replaced calls kzalloc followed by memcpy with call to kmemdup. > Patch found using coccinelle. > > Signed-off-by: Alexandru Gheorghiu > --- > drivers/gpu/drm/gma500/intel_bios.c |3 +-- > 1 file changed, 1 insertion(+), 2 deletio

drm/nouveau: port all engines to new engine module format

Hello Ben Skeggs, The patch ebb945a94bba: "drm/nouveau: port all engines to new engine module format" from Jul 20, 2012, leads to the following warning: "drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c:570 nvc0_graph_ctor() error: buffer overflow 'priv->tpc_nr' 4 <= 30" drivers/gpu/dr

Re: [PATCH] drm/i915: bounds check execbuffer relocations

On Mon, Mar 11, 2013 at 12:27:16PM -0700, Kees Cook wrote: > It is possible to wrap the counter used to allocate the buffer for > relocation copies. This could lead to heap writing overflows. Seems a sensible check, just in the wrong location. You need to do the checking upfront in validate_exec_l

Re: [PATCH] drm/i915: clarify reasoning for the access_ok call

On Mon, Mar 11, 2013 at 12:26:30PM -0700, Kees Cook wrote: > This clarifies the comment above the access_ok check so a missing > VERIFY_READ doesn't alarm anyone. Do we really need to copy the interface documentation? /** * access_ok: - Checks if a user space pointer is valid * @type: Type of a

[Bug 60439] Suspend/resume broken for cayman with 90a51a329258e3c868f6

: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/84e85bd5/attachment.html>

[Bug 56139] [bisected] kernel 3.7.0-rc1 breaks 6950 (boot/grub2 and suspend/resume) (CAYMAN)

-- You are receiving this mail because: You are the assignee for the bug. -- next part -- An HTML attachment was scrubbed... URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/dfd87ec3/attachment.html>

[Bug 60439] Suspend/resume broken for cayman with 90a51a329258e3c868f6

: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130311/23be5337/attachment.html>

Re: [PATCH V3] get_maintainer: use filename-only regex match for Tegra

On Mon, 2013-03-11 at 14:19 -0600, Stephen Warren wrote: > Create a new N: entry type in MAINTAINERS which performs a regex match > against filenames; either those extracted from patch +++ or --- lines, > or those specified on the command-line using the -f option. [] > Switch the Tegra entry from u

[PATCH] drivers: gpu: drm: gma500: Replaced calls kzalloc & memcpy with kmemdup

Replaced calls kzalloc followed by memcpy with call to kmemdup. Patch found using coccinelle. Signed-off-by: Alexandru Gheorghiu --- drivers/gpu/drm/gma500/intel_bios.c |3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/gpu/drm/gma500/intel_bios.c b/drivers/gpu/drm

[PATCH] drivers: gpu: drm: Replaced ERR_PTR & PTR_ERR with ERR_CAST

Replaced ERR_PTR and PTR_ERR calls with ERR_CAST. Patch found using coccinelle. Signed-off-by: Alexandru Gheorghiu --- drivers/gpu/drm/drm_prime.c |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index 366910d..4c8ad

  1   2   >