xavi/android_kernel_m2note/drivers/gpu, branch ng-7.1.2

format-security: move static strings to const

2017-12-05T17:06:11+00:00

While examining output from trial builds with -Wformat-security enabled, many strings were found that should be defined as "const", or as a char array instead of char pointer. This makes some static analysis easier, by producing fewer false positives. As these are all trivial changes, it seemed best to put them all in a single patch rather than chopping them up per maintainer. Link: http://lkml.kernel.org/r/20170405214711.GA5711@beast Signed-off-by: Kees Cook Acked-by: Jes Sorensen [runner.c] Cc: Tony Lindgren Cc: Russell King Cc: "Maciej W. Rozycki" Cc: Ralf Baechle Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Viresh Kumar Cc: Daniel Vetter Cc: Jani Nikula Cc: Sean Paul Cc: David Airlie Cc: Yisen Zhuang Cc: Salil Mehta Cc: Thomas Bogendoerfer Cc: Jiri Slaby Cc: Patrice Chotard Cc: "David S. Miller" Cc: James Hogan Cc: Paul Burton Cc: Matt Redfearn Cc: Paolo Bonzini Cc: Ingo Molnar Cc: Rasmus Villemoes Cc: Mugunthan V N Cc: Felipe Balbi Cc: Jarod Wilson Cc: Florian Westphal Cc: Antonio Quartulli Cc: Dmitry Torokhov Cc: Kejian Yan Cc: Daode Huang Cc: Qianqian Xie Cc: Philippe Reynes Cc: Colin Ian King Cc: Eric Dumazet Cc: Christian Gromm Cc: Andrey Shvetsov Cc: Jason Litzinger Cc: WANG Cong Signed-off-by: Andrew Morton

drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()

2017-11-06T14:30:27+00:00

commit f0c62e9878024300319ba2438adc7b06c6b9c448 upstream. If vmalloc() fails then we need to a bit of cleanup before returning. Cc: Fixes: fb1d9738ca05 ("drm/vmwgfx: Add DRM driver for VMware Virtual GPU") Signed-off-by: Dan Carpenter Reviewed-by: Sinclair Yeh Signed-off-by: Willy Tarreau

misc: replace FUNCTION by function

2017-09-23T01:10:48+00:00

result of : git grep -l '__FUNCTION__' | xargs sed -i 's/__FUNCTION__/__func__/g'

drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()

2017-07-04T10:11:18+00:00

commit e7e11f99564222d82f0ce84bd521e57d78a6b678 upstream. In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the 'req->mip_levels' array. This array can be assigned any value from the user space. As both the 'num_sizes' and the array is uint32_t, it is easy to make 'num_sizes' overflow. The later 'mip_levels' is used as the loop count. This can lead an oob write. Add the check of 'req->mip_levels' to avoid this. Signed-off-by: Li Qiang Reviewed-by: Thomas Hellstrom Signed-off-by: Jiri Slaby Signed-off-by: Willy Tarreau

drm/vmwgfx: Remove getparam error message

2017-07-04T10:11:17+00:00

commit 53e16798b0864464c5444a204e1bb93ae246c429 upstream. The mesa winsys sometimes uses unimplemented parameter requests to check for features. Remove the error message to avoid bloating the kernel log. Signed-off-by: Thomas Hellstrom Reviewed-by: Brian Paul Reviewed-by: Sinclair Yeh Signed-off-by: Jiri Slaby Signed-off-by: Willy Tarreau

drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()

2017-07-04T10:11:17+00:00

commit 63774069d9527a1aeaa4aa20e929ef5e8e9ecc38 upstream. In vmw_get_cap_3d_ioctl(), a user can supply 0 for a size that is used in vzalloc(). This eventually calls dump_stack() (in warn_alloc()), which can leak useful addresses to dmesg. Add check to avoid a size of 0. Signed-off-by: Murray McAllister Reviewed-by: Sinclair Yeh Signed-off-by: Jiri Slaby Signed-off-by: Willy Tarreau

drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()

2017-07-04T10:11:16+00:00

commit 36274ab8c596f1240c606bb514da329add2a1bcd upstream. Before memory allocations vmw_surface_define_ioctl() checks the upper-bounds of a user-supplied size, but does not check if the supplied size is 0. Add check to avoid NULL pointer dereferences. Signed-off-by: Murray McAllister Reviewed-by: Sinclair Yeh Signed-off-by: Jiri Slaby Signed-off-by: Willy Tarreau

drm/ttm: Make sure BOs being swapped out are cacheable

2017-07-04T09:51:39+00:00

commit 239ac65fa5ffab71adf66e642750f940e7241d99 upstream. The current caching state may not be tt_cached, even though the placement contains TTM_PL_FLAG_CACHED, because placement can contain multiple caching flags. Trying to swap out such a BO would trip up the BUG_ON(ttm->caching_state != tt_cached); in ttm_tt_swapout. Signed-off-by: Michel Dänzer Reviewed-by: Thomas Hellstrom Reviewed-by: Christian König . Reviewed-by: Sinclair Yeh Signed-off-by: Christian König Signed-off-by: Willy Tarreau

drm/ast: Fix test for VGA enabled

2017-07-04T09:51:38+00:00

commit 905f21a49d388de3e99438235f3301cabf0c0ef4 upstream. The test to see if VGA was already enabled is doing an unnecessary second test from a register that may or may not have been initialized to a valid value. Remove it. Signed-off-by: Y.C. Chen Signed-off-by: Benjamin Herrenschmidt Acked-by: Joel Stanley Tested-by: Y.C. Chen Signed-off-by: Dave Airlie Signed-off-by: Willy Tarreau

drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval

2017-07-04T09:51:31+00:00

commit 24bf7ae359b8cca165bb30742d2b1c03a1eb23af upstream. Based on the xf86-video-nv code, NFORCE (NV1A) and NFORCE2 (NV1F) have a different way of retrieving clocks. See the nv_hw.c:nForceUpdateArbitrationSettings function in the original code for how these clocks were accessed. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=54587 Signed-off-by: Ilia Mirkin Signed-off-by: Ben Skeggs Signed-off-by: Willy Tarreau