Commit 5ca5f00a authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2025-10-09' of... 

Merge tag 'drm-misc-fixes-2025-10-09' of https://gitlab.freedesktop.org/drm/misc/kernel

 into drm-fixes

Short summary of fixes pull:

nouveau:
- Return errno code from TTM move helper

vmwgfx:
- Fix null-ptr access in cursor code
- Fix UAF in validation
- Use correct iterator in validation

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://lore.kernel.org/r/20251009120004.GA17570@linux.fritz.box
parents e5f0a698 e4bea919

drivers/gpu/drm/nouveau/nouveau_bo.c

+1 −1
Original line number Diff line number Diff line
@@ -929,7 +929,7 @@ nouveau_bo_move_prep(struct nouveau_drm *drm, struct ttm_buffer_object *bo, 
		nvif_vmm_put(vmm, &old_mem->vma[1]);

		nvif_vmm_put(vmm, &old_mem->vma[0]);

	}

	return 0;

	return ret;

}



static int

drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c

+12 −5
Original line number Diff line number Diff line
@@ -1497,6 +1497,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, 
		       SVGA3dCmdHeader *header)

{

	struct vmw_bo *vmw_bo = NULL;

	struct vmw_resource *res;

	struct vmw_surface *srf = NULL;

	VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA);

	int ret;
@@ -1532,18 +1533,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, 


	dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ?

		VMW_RES_DIRTY_SET : 0;

	ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,

				dirty, user_surface_converter,

				&cmd->body.host.sid, NULL);

	ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty,

				user_surface_converter, &cmd->body.host.sid,

				NULL);

	if (unlikely(ret != 0)) {

		if (unlikely(ret != -ERESTARTSYS))

			VMW_DEBUG_USER("could not find surface for DMA.\n");

		return ret;

	}



	srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res);

	res = sw_context->res_cache[vmw_res_surface].res;

	if (!res) {

		VMW_DEBUG_USER("Invalid DMA surface.\n");

		return -EINVAL;

	}



	vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header);

	srf = vmw_res_to_srf(res);

	vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo,

			     header);



	return 0;

}

drivers/gpu/drm/vmwgfx/vmwgfx_validation.c

+4 −2
Original line number Diff line number Diff line
@@ -308,8 +308,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, 
		hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key);

	}

	node->res = vmw_resource_reference_unless_doomed(res);

	if (!node->res)

	if (!node->res) {

		hash_del_rcu(&node->hash.head);

		return -ESRCH;

	}



	node->first_usage = 1;

	if (!res->dev_priv->has_mob) {
@@ -636,7 +638,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx) 
		hash_del_rcu(&val->hash.head);



	list_for_each_entry(val, &ctx->resource_ctx_list, head)

		hash_del_rcu(&entry->hash.head);

		hash_del_rcu(&val->hash.head);



	ctx->sw_context = NULL;

}