p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
linux_old1/drivers/gpu/drm
History
Francisco Jerez 6a65c5b932 drm/i915: Fix command parser to validate multiple register access with the same command. 
Until now the software command checker assumed that commands could
read or write at most a single register per packet.  This is not
necessarily the case, MI_LOAD_REGISTER_IMM expects a variable-length
list of offset/value pairs and writes them in sequence.  The previous
code would only check whether the first entry was valid, effectively
allowing userspace to write unrestricted registers of the MMIO space
by sending a multi-register write with a legal first register, with
potential security implications on Gen6 and 7 hardware.

Fix it by extending the drm_i915_cmd_descriptor table to represent
multi-register access and making validate_cmd() iterate for all
register offsets present in the command packet.

Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Reviewed-by: Zhigang Gong <zhigang.gong@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
 		2015-06-15 12:34:26 +02:00
..
amd drm/amdkfd: Enforce kill all waves on process termination 2015-06-03 11:34:47 +03:00
armada Merge branch 'drm-armada-devel' of git://ftp.arm.linux.org.uk/~rmk/linux-arm into drm-next 2015-05-15 15:24:41 +10:00
ast
…
atmel-hlcdc drm: atmel-hlcdc: use appropriate enabled flag in suspend/resume 2015-03-16 16:10:42 +01:00
bochs drm/bochs: disable video before changing video mode 2015-04-01 08:28:15 +10:00
bridge Merge branch 'drm-dwhdmi-devel' of git://ftp.arm.linux.org.uk/~rmk/linux-arm into drm-next 2015-04-16 08:33:30 +10:00
cirrus Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux 2015-02-16 15:48:00 -08:00
exynos drm/exynos: dp: Lower level of EDID read success message 2015-05-19 22:50:55 +09:00
gma500 drm/gma500: constify all struct drm_*_helper funcs pointers 2015-04-07 17:06:41 +02:00
i2c Merge branch 'drm-tda998x-devel' of git://ftp.arm.linux.org.uk/~rmk/linux-arm into drm-next 2015-05-29 09:19:59 +10:00
i810
…
i915 drm/i915: Fix command parser to validate multiple register access with the same command. 2015-06-15 12:34:26 +02:00
imx Merge branch 'drm-dwhdmi-devel' of git://ftp.arm.linux.org.uk/~rmk/linux-arm into drm-next 2015-04-16 08:33:30 +10:00
mga
…
mgag200 drm/mgag200: constify all struct drm_*_helper funcs pointers 2015-04-07 17:06:41 +02:00
msm drm/msm/mdp5: fix incorrect parameter for msm_framebuffer_iova() 2015-05-21 14:31:45 +10:00
nouveau drm/nouveau/gr/gm204: remove a stray printk 2015-05-29 10:59:32 +10:00
omapdrm dma-buf: cleanup dma_buf_export() to make it easily extensible 2015-04-21 14:47:16 +05:30
panel drm/panel: Add support for Ampire AM-800480R3TMQW-A1H 800x480 7" panel 2015-04-02 19:04:15 +02:00
qxl drm/qxl: rewrite framebuffer support 2015-05-07 13:09:25 +10:00
r128
…
radeon Linux 4.1-rc6 2015-06-04 09:23:51 +10:00
rcar-du drm: rcar-du: Split planes pre-association 4/4 between CRTCs 2015-05-25 15:34:13 +03:00
rockchip drm/rockchip: fix error check when getting irq 2015-04-20 09:02:31 +08:00
savage
…
shmobile
…
sis
…
sti drm: sti: convert driver to atomic modeset 2015-03-19 13:35:16 +01:00
tdfx
…
tegra drm/tegra: Don't use vblank_disable_immediate on incapable driver. 2015-05-08 20:56:34 +10:00
tilcdc drm/tilcdc: Add DRM_TILCDC_SLAVE_COMPAT for ti,tilcdc,slave binding support 2015-05-27 13:13:33 +03:00
ttm drm/ttm: dma: Don't crash on memory in the vmalloc range 2015-06-02 17:24:49 +10:00
udl dma-buf: cleanup dma_buf_export() to make it easily extensible 2015-04-21 14:47:16 +05:30
vgem drm/vgem: drop DRIVER_PRIME (v2) 2015-05-26 16:17:06 +10:00
via
…
virtio Add virtio gpu driver. 2015-06-03 14:17:38 +02:00
vmwgfx Merge tag 'topic/drm-misc-2015-03-31' of git://anongit.freedesktop.org/drm-intel into drm-next 2015-04-01 08:23:25 +10:00
Kconfig Add virtio gpu driver. 2015-06-03 14:17:38 +02:00
Makefile Merge branch 'virtio-gpu-drm-next' of git://git.kraxel.org/linux into drm-next 2015-06-04 09:36:39 +10:00
ati_pcigart.c
…
drm_agpsupport.c
…
drm_atomic.c drm/atomic: Add MODE_ID property 2015-05-26 15:50:42 +02:00
drm_atomic_helper.c drm/atomic: Clear crtc_state->active in drm_atomic_helper_set_config. 2015-06-04 09:20:31 +10:00
drm_auth.c drm: simplify authentication management 2015-05-05 09:45:57 +02:00
drm_bridge.c drm/DocBook: Add more drm_bridge documentation 2015-05-21 13:56:51 +02:00
drm_bufs.c
…
drm_cache.c
…
drm_context.c
…
drm_crtc.c drm/atomic: Add MODE_ID property 2015-05-26 15:50:42 +02:00
drm_crtc_helper.c drm: Add drm_atomic_set_mode_for_crtc 2015-05-26 15:50:34 +02:00
drm_crtc_internal.h
…
drm_debugfs.c
…
drm_dma.c
…
drm_dp_helper.c drm: Fix for DP CTS test 4.2.2.5 - I2C DEFER handling 2015-04-20 09:29:41 -07:00
drm_dp_mst_topology.c Merge tag 'drm-intel-next-2015-03-13-merge' of git://anongit.freedesktop.org/drm-intel into drm-next 2015-03-24 11:12:20 +10:00
drm_drv.c drm: simplify master cleanup 2015-05-05 09:46:38 +02:00
drm_edid.c Merge tag 'topic/drm-misc-2015-05-19' of git://anongit.freedesktop.org/drm-intel into drm-next 2015-05-20 09:19:58 +10:00
drm_edid_load.c drm: Add edid_corrupt flag for Displayport Link CTS 4.2.2.6 2015-05-08 13:03:46 +02:00
drm_encoder_slave.c
…
drm_fb_cma_helper.c drm/cma: use correct fb width/height 2015-03-11 22:08:07 +01:00
drm_fb_helper.c drm/drm: constify all struct drm_*_helper funcs pointers 2015-04-07 18:11:25 +02:00
drm_flip_work.c drm/core: get rid of -Iinclude/drm 2015-05-13 11:28:22 +02:00
drm_fops.c drm/mode: Add user blob-creation ioctl 2015-05-22 16:18:28 +02:00
drm_gem.c
…
drm_gem_cma_helper.c
…
drm_global.c
…
drm_hashtab.c
…
drm_info.c drm: Silence sparse warnings 2015-03-13 17:37:35 +01:00
drm_internal.h drm: simplify authentication management 2015-05-05 09:45:57 +02:00
drm_ioc32.c drm: Silence sparse warnings 2015-03-13 17:37:35 +01:00
drm_ioctl.c drm/mode: Add user blob-creation ioctl 2015-05-22 16:18:28 +02:00
drm_irq.c Merge branch 'virtio-gpu-drm-next' of git://git.kraxel.org/linux into drm-next 2015-06-04 09:36:39 +10:00
drm_legacy.h
…
drm_lock.c
…
drm_memory.c
…
drm_mipi_dsi.c
…
drm_mm.c drm: clean up drm_mm debugfs output 2015-05-29 09:17:57 +10:00
drm_modes.c drm/mode: Unstatic kernel-userspace mode conversion 2015-05-22 16:18:21 +02:00
drm_modeset_lock.c drm: fix a memleak on mutex failure path 2015-05-05 09:26:43 +02:00
drm_of.c drm: use for_each_endpoint_of_node macro in drm_of_find_possible_crtcs 2015-04-08 11:14:25 +02:00
drm_panel.c
…
drm_pci.c drm: Silence sparse warnings 2015-03-13 17:37:35 +01:00
drm_plane_helper.c drm/plane-helper: Adapt cursor hack to transitional helpers 2015-05-22 08:48:08 +03:00
drm_platform.c
…
drm_prime.c drm/prime: Allow internal imports without import_sg_table 2015-05-12 11:02:50 +02:00
drm_probe_helper.c Merge tag 'topic/drm-misc-2015-05-06' of git://anongit.freedesktop.org/drm-intel into drm-next 2015-05-07 13:02:39 +10:00
drm_rect.c
…
drm_scatter.c
…
drm_sysfs.c drm/sysfs: remove unnecessary connector type checks 2015-05-12 19:15:53 +02:00
drm_trace.h tracing/drm: Remove unused TRACE_SYSTEM_STRING define 2015-04-07 12:29:23 -04:00
drm_trace_points.c
…
drm_vm.c drm: Silence sparse warnings 2015-03-13 17:37:35 +01:00
drm_vma_manager.c
…