Chris Wilson 8adabb8928 drm/i915: Pevent copying uninitialised garbage into vma->ggtt_view ... Since tweaking i915_vma_compare() we allowed constructors to skip clearing the ggtt_view believing that we didn't access the unused members. That, as it turns out, was not entirely true. In particular, i915_gem_fault() uses ret = remap_io_mapping(area, area->vm_start + (vma->ggtt_view.partial.offset << PAGE_SHIFT), (ggtt->mappable_base + vma->node.start) >> PAGE_SHIFT, min_t(u64, vma->size, area->vm_end - area->vm_start), &ggtt->mappable); i.e. the ggtt_view.partial for both normal and partial views. If we allowed garbage into the normal vma->ggtt_view and then try userspace tried to mmap it, we could explode in an unobvious fashion. Fixes: 7b92c047ba ("drm/i915: Eliminate superfluous i915_ggtt_view_rotated") Fixes: 3bf4d57519 ("drm/i915: Stop clearing i915_ggtt_view") Reported-by: Matthew Auld <matthew.william.auld@gmail.com> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Cc: Matthew Auld <matthew.william.auld@gmail.com> Link: http://patchwork.freedesktop.org/patch/msgid/20170123145245.3972-1-chris@chris-wilson.co.uk Tested-by: Matthew Auld <matthew.auld@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> (cherry picked from commit 7c51846030)		2017-01-26 11:10:33 +01:00
..
drm	drm/i915: Pevent copying uninitialised garbage into vma->ggtt_view	2017-01-26 11:10:33 +01:00
host1x	gpu: host1x: Add locking to syncpt	2016-11-11 15:33:13 +01:00
ipu-v3	imx-drm plane update cleanup, YUV formats	2016-11-11 09:31:27 +10:00
vga	vgaarb: use valid dev pointer in vgaarb_info()	2016-11-22 16:40:35 +01:00
Makefile