1. Jun 15, 2017
  2. Jun 13, 2017
    • Christophe JAILLET's avatar
      drm/vc4: Fix resource leak in 'vc4_get_hang_state_ioctl()' in error handling path · d0b1d259
      Christophe JAILLET authored
      
      
      If one 'drm_gem_handle_create()' fails, we leak somes handles and some
      memory.
      
      In order to fix it:
        - move the 'free(bo_state)' at the end of the function so that it is also
          called in the eror handling path. This has the side effect to also try
          to free it if the first 'kcalloc' fails. This is harmless.
        - add a new label, err_delete_handle, in order to delete already
          allocated handles in error handling path
        - remove the now useless 'err' label
      
      The way the code is now written will also delete the handles if the
      'copy_to_user()' call fails.
      
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Reviewed-by: default avatarEric Anholt <eric@anholt.net>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170512123803.1886-1-christophe.jaillet@wanadoo.fr
      d0b1d259
    • Hans Verkuil's avatar
      drm/vc4/vc4_bo.c: always set bo->resv · 24bb206f
      Hans Verkuil authored
      
      
      The bo->resv pointer could be NULL, leading to kernel oopses
      like the one below.
      
      This patch ensures that bo->resv is always set in vc4_create_object
      ensuring that it is never NULL.
      
      Thanks to Eric Anholt for pointing to the correct solution.
      
      [   19.738487] Unable to handle kernel NULL pointer dereference at virtual address 00000000
      [   19.746805] pgd = ffff8000275fc000
      [   19.750319] [00000000] *pgd=0000000000000000
      [   19.754715] Internal error: Oops: 96000004 [#1] PREEMPT SMP
      [   19.760369] Modules linked in: smsc95xx usbnet vc4 drm_kms_helper drm pwm_bcm2835 i2c_bcm2835 bcm2835_rng rng_core bcm2835_dma virt_dma
      [   19.772767] CPU: 0 PID: 1297 Comm: Xorg Not tainted 4.12.0-rc1-rpi3 #58
      [   19.779476] Hardware name: Raspberry Pi 3 Model B (DT)
      [   19.784688] task: ffff800028268000 task.stack: ffff800026c08000
      [   19.790705] PC is at ww_mutex_lock_interruptible+0x14/0xc0
      [   19.796329] LR is at vc4_submit_cl_ioctl+0x4fc/0x998 [vc4]
      ...
      [   20.240855] [<ffff0000088975f4>] ww_mutex_lock_interruptible+0x14/0xc0
      [   20.247528] [<ffff0000009b3ea4>] vc4_submit_cl_ioctl+0x4fc/0x998 [vc4]
      [   20.254372] [<ffff0000008f75f8>] drm_ioctl+0x180/0x438 [drm]
      [   20.260120] [<ffff00000821383c>] do_vfs_ioctl+0xa4/0x7d0
      [   20.265510] [<ffff000008213fe4>] SyS_ioctl+0x7c/0x98
      [   20.270550] [<ffff000008082f30>] el0_svc_naked+0x24/0x28
      [   20.275941] Code: d2800002 d5384103 910003fd f9800011 (c85ffc04)
      [   20.282527] ---[ end trace 1f6bd640ff32ae12 ]---
      
      Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
      Reviewed-by: default avatarEric Anholt <eric@anholt.net>
      Link: http://patchwork.freedesktop.org/patch/msgid/14e68768-6c92-2d74-92fd-196dbc50d8f7@xs4all.nl
      24bb206f
  3. Jun 09, 2017
  4. Jun 08, 2017
  5. Jun 07, 2017
  6. Jun 05, 2017
  7. Jun 03, 2017
  8. Jun 02, 2017
  9. Jun 01, 2017
  10. May 31, 2017