1. 07 Dec, 2021 15 commits
  2. 02 Dec, 2021 5 commits
    • Zhou Qingyang's avatar
      drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() · ab50cb9d
      Zhou Qingyang authored
      In radeon_driver_open_kms(), radeon_vm_bo_add() is assigned to
      vm->ib_bo_va and passes and used in radeon_vm_bo_set_addr(). In
      radeon_vm_bo_set_addr(), there is a dereference of vm->ib_bo_va,
      which could lead to a NULL pointer dereference on failure of
      radeon_vm_bo_add().
      
      Fix this bug by adding a check of vm->ib_bo_va.
      
      This bug was found by a static analyzer. The analysis employs
      differential checking to identify inconsistent security operations
      (e.g., checks or kfrees) between two code paths and confirms that the
      inconsistent operations are not recovered in the current function or
      the callers, so they constitute bugs.
      
      Note that, as a bug found by static analysis, it can be a false
      positive or hard to trigger. Multiple researchers have cross-reviewed
      the bug.
      
      Builds with CONFIG_DRM_RADEON=m show no new warnings,
      and our static analyzer no longer warns about this code.
      
      Fixes: cc9e67e3 ("drm/radeon: fix VM IB handling")
      Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarZhou Qingyang <zhou1615@umn.edu>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      ab50cb9d
    • Vlad Zahorodnii's avatar
      drm/amd/display: Use oriented source size when checking cursor scaling · 69cb5629
      Vlad Zahorodnii authored
      dm_check_crtc_cursor() doesn't take into account plane transforms when
      calculating plane scaling, this can result in false positives.
      
      For example, if there's an output with resolution 3840x2160 and the
      output is rotated 90 degrees, CRTC_W and CRTC_H will be 3840 and 2160,
      respectively, but SRC_W and SRC_H will be 2160 and 3840, respectively.
      
      Since the cursor plane usually has a square buffer attached to it, the
      dm_check_crtc_cursor() will think that there's a scale factor mismatch
      even though there isn't really.
      
      This fixes an issue where kwin fails to use hardware plane transforms.
      
      Changes since version 1:
      - s/orientated/oriented/g
      Reviewed-by: default avatarNicholas Kazlauskas <nicholas.kazlauskas@amd.com>
      Signed-off-by: default avatarVlad Zahorodnii <vlad.zahorodnii@kde.org>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      69cb5629
    • Zhou Qingyang's avatar
      drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() · b220110e
      Zhou Qingyang authored
      In amdgpu_connector_lcd_native_mode(), the return value of
      drm_mode_duplicate() is assigned to mode, and there is a dereference
      of it in amdgpu_connector_lcd_native_mode(), which will lead to a NULL
      pointer dereference on failure of drm_mode_duplicate().
      
      Fix this bug add a check of mode.
      
      This bug was found by a static analyzer. The analysis employs
      differential checking to identify inconsistent security operations
      (e.g., checks or kfrees) between two code paths and confirms that the
      inconsistent operations are not recovered in the current function or
      the callers, so they constitute bugs.
      
      Note that, as a bug found by static analysis, it can be a false
      positive or hard to trigger. Multiple researchers have cross-reviewed
      the bug.
      
      Builds with CONFIG_DRM_AMDGPU=m show no new warnings, and
      our static analyzer no longer warns about this code.
      
      Fixes: d38ceaf9 ("drm/amdgpu: add core driver (v4)")
      Signed-off-by: default avatarZhou Qingyang <zhou1615@umn.edu>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      b220110e
    • Alex Deucher's avatar
      drm/amdgpu: handle SRIOV VCN revision parsing · baf3f8f3
      Alex Deucher authored
      For SR-IOV, the IP discovery revision number encodes
      additional information.  Handle that case here.
      
      v2: drop additional IP versions
      Reviewed-by: default avatarGuchun Chen <guchun.chen@amd.com>
      Acked-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      baf3f8f3
    • Stanley.Yang's avatar
      drm/amdgpu: skip query ecc info in gpu recovery · bab73f09
      Stanley.Yang authored
      this is a workaround due to get ecc info failed during gpu recovery
      
      [  700.236122] amdgpu 0000:09:00.0: amdgpu: Failed to export SMU ecc table!
      [  700.236128] amdgpu 0000:09:00.0: amdgpu: GPU reset begin!
      [  704.331171] amdgpu: qcm fence wait loop timeout expired
      [  704.331194] amdgpu: The cp might be in an unrecoverable state due to an unsuccessful queues preemption
      [  704.332445] amdgpu 0000:09:00.0: amdgpu: GPU reset begin!
      [  704.332448] amdgpu 0000:09:00.0: amdgpu: Bailing on TDR for s_job:ffffffffffffffff, as another already in progress
      [  704.332456] amdgpu: Pasid 0x8000 destroy queue 0 failed, ret -62
      [  710.360924] amdgpu 0000:09:00.0: amdgpu: SMU: I'm not done with your previous command: SMN_C2PMSG_66:0x00000013 SMN_C2PMSG_82:0x00000007
      [  710.360964] amdgpu 0000:09:00.0: amdgpu: Failed to disable smu features.
      [  710.361002] amdgpu 0000:09:00.0: amdgpu: Fail to disable dpm features!
      [  710.361014] [drm:amdgpu_device_ip_suspend_phase2 [amdgpu]] *ERROR* suspend of IP block <smu> failed -62
      Signed-off-by: default avatarStanley.Yang <Stanley.Yang@amd.com>
      Reviewed-by: default avatarHawking Zhang <Hawking.Zhang@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      bab73f09
  3. 01 Dec, 2021 20 commits