Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'drm-fixes-2025-10-11' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"Some fixes leftover from our fixes branch, just nouveau and vmwgfx:
nouveau:
- Return errno code from TTM move helper
vmwgfx:
- Fix null-ptr access in cursor code
- Fix UAF in validation
- Use correct iterator in validation"
* tag 'drm-fixes-2025-10-11' of https://gitlab.freedesktop.org/drm/kernel:
drm/nouveau: fix bad ret code in nouveau_bo_move_prep
drm/vmwgfx: Fix copy-paste typo in validation
drm/vmwgfx: Fix Use-after-free in validation
drm/vmwgfx: Fix a null-ptr access in the cursor snooper
+17
-8
+1
-1
drivers/gpu/drm/nouveau/nouveau_bo.c
+1
-1
drivers/gpu/drm/nouveau/nouveau_bo.c
+12
-5
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+12
-5
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
···
1497
1497
SVGA3dCmdHeader *header)
1498
1498
{
1499
1499
struct vmw_bo *vmw_bo = NULL;
1500
+
struct vmw_resource *res;
1500
1501
struct vmw_surface *srf = NULL;
1501
1502
VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA);
1502
1503
int ret;
···
1533
1532
1534
1533
dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ?
1535
1534
VMW_RES_DIRTY_SET : 0;
1536
-
ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
1537
-
dirty, user_surface_converter,
1538
-
&cmd->body.host.sid, NULL);
1535
+
ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty,
1536
+
user_surface_converter, &cmd->body.host.sid,
1537
+
NULL);
1539
1538
if (unlikely(ret != 0)) {
1540
1539
if (unlikely(ret != -ERESTARTSYS))
1541
1540
VMW_DEBUG_USER("could not find surface for DMA.\n");
1542
1541
return ret;
1543
1542
}
1544
1543
1545
-
srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res);
1544
+
res = sw_context->res_cache[vmw_res_surface].res;
1545
+
if (!res) {
1546
+
VMW_DEBUG_USER("Invalid DMA surface.\n");
1547
+
return -EINVAL;
1548
+
}
1546
1549
1547
-
vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header);
1550
+
srf = vmw_res_to_srf(res);
1551
+
vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo,
1552
+
header);
1548
1553
1549
1554
return 0;
1550
1555
}
+4
-2
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+4
-2
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
···
308
308
hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key);
309
309
}
310
310
node->res = vmw_resource_reference_unless_doomed(res);
311
-
if (!node->res)
311
+
if (!node->res) {
312
+
hash_del_rcu(&node->hash.head);
312
313
return -ESRCH;
314
+
}
313
315
314
316
node->first_usage = 1;
315
317
if (!res->dev_priv->has_mob) {
···
638
636
hash_del_rcu(&val->hash.head);
639
637
640
638
list_for_each_entry(val, &ctx->resource_ctx_list, head)
641
-
hash_del_rcu(&entry->hash.head);
639
+
hash_del_rcu(&val->hash.head);
642
640
643
641
ctx->sw_context = NULL;
644
642
}