Linux 4.14.264
Greg Kroah-Hartman
maintainerI'm announcing the release of the 4.14.264 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 drivers/gpu/drm/i915/i915_drv.h | 2 drivers/gpu/drm/i915/i915_gem.c | 84 +++++++++++++++++++++++++++++++- drivers/gpu/drm/i915/i915_gem_object.h | 1 drivers/gpu/drm/i915/i915_reg.h | 6 ++ drivers/gpu/drm/i915/i915_vma.c | 4 + drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 5 - drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 34 ++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 2 net/can/bcm.c | 20 +++---- 11 files changed, 128 insertions(+), 34 deletions(-)
Greg Kroah-Hartman (1):
Linux 4.14.264
Mathias Krause (1):
drm/vmwgfx: Fix stale file descriptors on failed usercopy
Tvrtko Ursulin (1):
drm/i915: Flush TLBs before releasing backing store
Ziyang Xuan (1):
can: bcm: fix UAF of bcm op
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 4 PATCHLEVEL = 14 -SUBLEVEL = 263 +SUBLEVEL = 264 EXTRAVERSION = NAME = Petit Gorille
drivers/gpu/drm/i915/i915_drv.h +2 -0
@@ -2166,6 +2166,8 @@ struct drm_i915_private {struct intel_uncore uncore; +struct mutex tlb_invalidate_lock; +struct i915_virtual_gpu vgpu;struct intel_gvt *gvt;
drivers/gpu/drm/i915/i915_gem.c +83 -1
103 lines not on this page · raw message
drivers/gpu/drm/i915/i915_gem_object.h +1 -0
@@ -135,6 +135,7 @@ struct drm_i915_gem_object {* activity? */ #define I915_BO_ACTIVE_REF 0 +#define I915_BO_WAS_BOUND_BIT 1/* * Is the object to be mapped as read-only to the GPU
drivers/gpu/drm/i915/i915_reg.h +6 -0
@@ -2380,6 +2380,12 @@ enum i915_power_well_id {#define GAMT_CHKN_BIT_REG _MMIO(0x4ab8)#define GAMT_CHKN_DISABLE_DYNAMIC_CREDIT_SHARING (1<<28) +#define GEN8_RTCR _MMIO(0x4260) +#define GEN8_M1TCR _MMIO(0x4264) +#define GEN8_M2TCR _MMIO(0x4268) +#define GEN8_BTCR _MMIO(0x426c) +#define GEN8_VTCR _MMIO(0x4270) +#if 0 #define PRB0_TAIL _MMIO(0x2030)#define PRB0_HEAD _MMIO(0x2034)
drivers/gpu/drm/i915/i915_vma.c +4 -0
@@ -272,6 +272,10 @@ int i915_vma_bind(struct i915_vma *vma, enum i915_cache_level cache_level,return ret; vma->flags |= bind_flags; + +if (vma->obj) +set_bit (I915_BO_WAS_BOUND_BIT , &vma->obj->flags); +return 0 ; }
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +2 -3
@@ -837,15 +837,14 @@ extern int vmw_execbuf_fence_commands(struct drm_file *file_priv,struct vmw_private *dev_priv, struct vmw_fence_obj **p_fence, uint32_t *p_handle); -extern void vmw_execbuf_copy_fence_user (struct vmw_private *dev_priv, +extern int vmw_execbuf_copy_fence_user (struct vmw_private *dev_priv,struct vmw_fpriv *vmw_fp,int ret,struct drm_vmw_fence_rep __user *user_fence_rep,struct vmw_fence_obj *fence,uint32_t fence_handle, -int32_t out_fence_fd, -struct sync_file *sync_file); +int32_t out_fence_fd); extern int vmw_validate_single_buffer(struct vmw_private *dev_priv, struct ttm_buffer_object *bo, bool interruptible,
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +17 -17
@@ -3848,20 +3848,19 @@ int vmw_execbuf_fence_commands(struct drm_file *file_priv,* object so we wait for it immediately, and then unreference the * user-space reference. */ -void +int vmw_execbuf_copy_fence_user (struct vmw_private *dev_priv,struct vmw_fpriv *vmw_fp,int ret,struct drm_vmw_fence_rep __user *user_fence_rep,struct vmw_fence_obj *fence,uint32_t fence_handle, -int32_t out_fence_fd, -struct sync_file *sync_file) +int32_t out_fence_fd) {struct drm_vmw_fence_rep fence_rep;if (user_fence_rep ==NULL ) -return ; +return 0 ;memset (&fence_rep,0 ,sizeof (fence_rep));
@@ -3889,20 +3888,14 @@ vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,* and unreference the handle. */ if (unlikely (ret !=0 ) && (fence_rep.error ==0 )) { -if (sync_file) -fput (sync_file->file); - -if (fence_rep.fd !=-1 ) { -put_unused_fd (fence_rep.fd); - fence_rep.fd =-1 ; - } -ttm_ref_object_base_unref (vmw_fp->tfile, fence_handle,TTM_REF_USAGE );DRM_ERROR ("Fence copy error. Syncing.\n" ); (void )vmw_fence_obj_wait (fence, false, false,VMW_FENCE_WAIT_TIMEOUT ); } + +return ret ? -EFAULT :0 ; }/**
@@ -4262,16 +4255,23 @@ int vmw_execbuf_process(struct drm_file *file_priv, (void )vmw_fence_obj_wait (fence, false, false,VMW_FENCE_WAIT_TIMEOUT ); + } + } + + ret =vmw_execbuf_copy_fence_user (dev_priv,vmw_fpriv (file_priv), ret, + user_fence_rep, fence, handle, out_fence_fd); + +if (sync_file) { +if (ret) { +/* usercopy of fence failed, put the file object */ +fput (sync_file->file); +put_unused_fd (out_fence_fd); }else {/* Link the fence with the FD created earlier */ fd_install (out_fence_fd, sync_file->file); } } -vmw_execbuf_copy_fence_user (dev_priv,vmw_fpriv (file_priv), ret, - user_fence_rep, fence, handle, - out_fence_fd, sync_file); -/* Don't unreference when handing fence out */ if (unlikely (out_fence !=NULL )) { *out_fence = fence;
@@ -4290,7 +4290,7 @@ int vmw_execbuf_process(struct drm_file *file_priv,*/ vmw_resource_list_unreference (sw_context, &resource_list); -return 0 ; +return ret; out_unlock_binding:mutex_unlock (&dev_priv->binding_mutex);
drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +1 -1
@@ -1150,7 +1150,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data, }vmw_execbuf_copy_fence_user (dev_priv, vmw_fp,0 , user_fence_rep, fence, - handle,-1 ,NULL ); + handle,-1 );vmw_fence_obj_unreference (&fence);return 0 ; out_no_create:
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +1 -1
@@ -2511,7 +2511,7 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv,if (file_priv)vmw_execbuf_copy_fence_user (dev_priv,vmw_fpriv (file_priv), ret, user_fence_rep, fence, - handle,-1 ,NULL ); + handle,-1 );if (out_fence) *out_fence = fence;else
net/can/bcm.c +10 -10
@@ -762,21 +762,21 @@ static struct bcm_op *bcm_find_op(struct list_head *ops,static void bcm_remove_op (struct bcm_op *op) {if (op->tsklet.func) { -while (test_bit (TASKLET_STATE_SCHED , &op->tsklet.state) || -test_bit (TASKLET_STATE_RUN , &op->tsklet.state) || -hrtimer_active (&op->timer)) { -hrtimer_cancel (&op->timer); +do {tasklet_kill (&op->tsklet); - } +hrtimer_cancel (&op->timer); + }while (test_bit (TASKLET_STATE_SCHED , &op->tsklet.state) || +test_bit (TASKLET_STATE_RUN , &op->tsklet.state) || +hrtimer_active (&op->timer)); }if (op->thrtsklet.func) { -while (test_bit (TASKLET_STATE_SCHED , &op->thrtsklet.state) || -test_bit (TASKLET_STATE_RUN , &op->thrtsklet.state) || -hrtimer_active (&op->thrtimer)) { -hrtimer_cancel (&op->thrtimer); +do {tasklet_kill (&op->thrtsklet); - } +hrtimer_cancel (&op->thrtimer); + }while (test_bit (TASKLET_STATE_SCHED , &op->thrtsklet.state) || +test_bit (TASKLET_STATE_RUN , &op->thrtsklet.state) || +hrtimer_active (&op->thrtimer)); }if ((op->frames) && (op->frames != &op->sframe))