search for: u_free

...nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c index 177b86d5..779d702 100644 --- a/drivers/gpu/drm/nouveau/nouveau_gem.c +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c @@ -584,18 +584,34 @@ nouveau_gem_pushbuf_validate(struct nouveau_channel *chan, return 0; } +static inline void +u_free(void *addr) +{ + if (!is_vmalloc_addr(addr)) + kfree(addr); + else + vfree(addr); +} + static inline void * u_memcpya(uint64_t user, unsigned nmemb, unsigned size) { void *mem; void __user *userptr = (void __force __user *)(uintptr_t)user; - mem = kmalloc(nmemb * size, GFP_KERNEL); + if...

...c_apply() is never reached. This causes a regression with graphical corruption, triggered when relocations need to be done (for example after a suspend/resume cycle.) Fix by setting *apply_relocs value only if there were more than 0 relocations. Additionally, the never reached code had a leftover u_free() call, which, after fixing the logic, now got called and resulted in a double-free. Fix by removing one u_free(), moving the other and adding check for errors. Cc: Daniel Vetter <daniel.vetter at ffwll.ch> Cc: Ben Skeggs <bskeggs at redhat.com> Cc: nouveau at lists.freedesktop.org Cc:...

...ouveau_gem.c > index 177b86d5..779d702 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_gem.c > +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c > @@ -584,18 +584,34 @@ nouveau_gem_pushbuf_validate(struct nouveau_channel *chan, > return 0; > } > > +static inline void > +u_free(void *addr) > +{ > + if (!is_vmalloc_addr(addr)) > + kfree(addr); > + else > + vfree(addr); > +} > + > static inline void * > u_memcpya(uint64_t user, unsigned nmemb, unsigned size) > { > void *mem; > voi...

...o __user *upbbo = + u64_to_user_ptr(req->buffers); + + for (i = 0; i < req->nr_buffers; i++) { + if (bo[i].presumed.valid) + continue; + + if (copy_to_user(&upbbo[i].presumed, &bo[i].presumed, + sizeof(bo[i].presumed))) { + ret = -EFAULT; + break; + } + } + u_free(reloc); + } out_prevalid: u_free(bo); u_free(push); -- 2.23.0.rc1

...o __user *upbbo = + u64_to_user_ptr(req->buffers); + + for (i = 0; i < req->nr_buffers; i++) { + if (bo[i].presumed.valid) + continue; + + if (copy_to_user(&upbbo[i].presumed, &bo[i].presumed, + sizeof(bo[i].presumed))) { + ret = -EFAULT; + break; + } + } + u_free(reloc); + } out_prevalid: u_free(bo); u_free(push); -- 2.23.0

...o __user *upbbo = + u64_to_user_ptr(req->buffers); + + for (i = 0; i < req->nr_buffers; i++) { + if (bo[i].presumed.valid) + continue; + + if (copy_to_user(&upbbo[i].presumed, &bo[i].presumed, + sizeof(bo[i].presumed))) { + ret = -EFAULT; + break; + } + } + u_free(reloc); + } out_prevalid: u_free(bo); u_free(push); -- 2.24.0.rc2

...eq->relocs, req->nr_relocs, sizeof(*reloc)); if (IS_ERR(reloc)) { ret = PTR_ERR(reloc); - goto out_prevalid; + goto out_free_bo; } goto revalidate; @@ -929,6 +929,7 @@ nouveau_gem_ioctl_pushbuf(struct drm_device *dev, void *data, out_prevalid: if (!IS_ERR(reloc)) u_free(reloc); +out_free_bo: u_free(bo); u_free(push); -- 2.40.0

...o __user *upbbo = + u64_to_user_ptr(req->buffers); + + for (i = 0; i < req->nr_buffers; i++) { + if (bo[i].presumed.valid) + continue; + + if (copy_to_user(&upbbo[i].presumed, &bo[i].presumed, + sizeof(bo[i].presumed))) { + ret = -EFAULT; + break; + } + } + u_free(reloc); + } out_prevalid: u_free(bo); u_free(push); -- 2.23.0.rc1

...+ > + for (i = 0; i < req->nr_buffers; i++) { > + if (bo[i].presumed.valid) > + continue; > + > + if (copy_to_user(&upbbo[i].presumed, &bo[i].presumed, > + sizeof(bo[i].presumed))) { > + ret = -EFAULT; > + break; > + } > + } > + u_free(reloc); > + } > out_prevalid: > u_free(bo); > u_free(push); > -- > 2.23.0.rc1 > -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch

...+ > + for (i = 0; i < req->nr_buffers; i++) { > + if (bo[i].presumed.valid) > + continue; > + > + if (copy_to_user(&upbbo[i].presumed, &bo[i].presumed, > + sizeof(bo[i].presumed))) { > + ret = -EFAULT; > + break; > + } > + } > + u_free(reloc); > + } > out_prevalid: > u_free(bo); > u_free(push); > -- > 2.24.0.rc2 > -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch

...ouveau_gem.c @@ -587,15 +587,9 @@ u_memcpya(uint64_t user, unsigned nmemb, unsigned size) void __user *userptr = (void __force __user *)(uintptr_t)user; size *= nmemb; - - mem = kvmalloc(size, GFP_KERNEL); - if (!mem) - return ERR_PTR(-ENOMEM); - - if (copy_from_user(mem, userptr, size)) { - u_free(mem); - return ERR_PTR(-EFAULT); - } + mem = vmemdup_user(userptr, size); + if (IS_ERR(mem)) + return ERR_PTR(PTR_ERR(mem)); return mem; } -- 2.28.0

From: Maarten Lankhorst <maarten.lankhorst at canonical.com> Commit de7b7d59d54852c introduced tiled GART, but a linear copy is still performed. This may result in errors on eviction, fix it by checking tiling from memtype. Signed-off-by: Maarten Lankhorst <maarten.lankhorst at canonical.com> Cc: stable at vger.kernel.org #3.10+ --- drivers/gpu/drm/nouveau/nouveau_bo.c | 33

From: Thierry Reding <treding at nvidia.com> Hi, This series implements a new IOCTL to submit push buffers that can optionally return a sync FD or sync object to userspace. This is useful in cases where userspace wants to synchronize operations between the GPU and another driver (such as KMS for display). Among other things this allows extensions such as eglDupNativeFenceFDANDROID to be

...rs/gpu/drm/nouveau/nouveau_gem.c +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c @@ -591,14 +591,9 @@ u_memcpya(uint64_t user, unsigned nmemb, unsigned size) size *= nmemb; - mem = kvmalloc(size, GFP_KERNEL); - if (!mem) - return ERR_PTR(-ENOMEM); - - if (copy_from_user(mem, userptr, size)) { - u_free(mem); - return ERR_PTR(-EFAULT); - } + mem = vmemdup_user(userptr, size); + if (IS_ERR(mem)) + return ERR_CAST(mem); return mem; } -- 2.7.4