Murray McAllister 36796bd899 drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define() ...

commit bcd6aa7b6c upstream.

If SVGA_3D_CMD_DX_DEFINE_RENDERTARGET_VIEW is called with a surface
ID of SVGA3D_INVALID_ID, the srf struct will remain NULL after
vmw_cmd_res_check(), leading to a null pointer dereference in
vmw_view_add().

Cc: <stable@vger.kernel.org>
Fixes: d80efd5cb3 ("drm/vmwgfx: Initial DX support")
Signed-off-by: Murray McAllister <murray.mcallister@gmail.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-06-22 08:17:20 +02:00

..

device_include

drm/vmwgfx: remove userland definition of DIV_ROUND_UP

2016-03-04 16:10:36 -05:00

Kconfig

drm/vmwgfx: select CONFIG_FB

2016-08-12 10:41:46 +02:00

Makefile

drm/vmwgfx: Report vmwgfx version to vmware.log

2016-05-20 17:40:07 +02:00

vmwgfx_binding.c

drm/vmwgfx: Initial DX support

2015-08-12 10:06:32 -07:00

vmwgfx_binding.h

drm/vmwgfx: Initial DX support

2015-08-12 10:06:32 -07:00

vmwgfx_buffer.c

drm/ttm: implement LRU add callbacks v2

2016-05-04 20:21:38 -04:00

vmwgfx_cmdbuf_res.c

drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr

2017-07-05 14:40:18 +02:00

vmwgfx_cmdbuf.c

drm/vmwgfx: use *_32_bits() macros

2016-06-15 13:10:38 +02:00

vmwgfx_context.c

Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next

2015-08-17 16:03:48 +10:00

vmwgfx_cotable.c

drm/ttm: remove lazy parameter from ttm_bo_wait

2016-05-04 20:21:26 -04:00

vmwgfx_dmabuf.c

drm/vmwgfx: Check pin count before attempting to move a buffer

2016-07-01 10:47:50 -07:00

vmwgfx_drv.c

drm/vmwgfx: Don't send drm sysfs hotplug events on initial master set

2019-06-11 12:22:43 +02:00

vmwgfx_drv.h

drm/vmwgfx: Work around drm removal of control nodes

2017-03-15 10:02:49 +08:00

vmwgfx_execbuf.c

drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define()

2019-06-22 08:17:20 +02:00

vmwgfx_fb.c

drm/vmwgfx: Don't double-free the mode stored in par->set_mode

2019-03-27 14:13:01 +09:00

vmwgfx_fence.c

drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces

2017-04-12 12:41:10 +02:00

vmwgfx_fence.h

drm/vmwgfx: Nuke preclose hook

2016-02-08 09:55:53 +01:00

vmwgfx_fifo.c

drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()

2017-06-14 15:06:03 +02:00

vmwgfx_gmr.c

drm/vmwgfx: Fix copyright headers

2015-08-12 10:06:56 -07:00

vmwgfx_gmrid_manager.c

drm/ttm: move fpfn and lpfn into each placement v2

2014-08-27 13:16:04 +02:00

vmwgfx_ioctl.c

drm/vmwgfx: Remove getparam error message

2017-04-12 12:41:10 +02:00

vmwgfx_irq.c

drm/vmwgfx: Relax irq locking somewhat

2015-11-06 16:15:40 +01:00

vmwgfx_kms.c

drm/vmwgfx: Fix a buffer object leak

2018-05-09 09:50:22 +02:00

vmwgfx_kms.h

drm/vmwgfx: Fix a destoy-while-held mutex problem.

2018-03-28 18:39:22 +02:00

vmwgfx_ldu.c

drm/kms: Nuke dirty_info property

2016-08-16 16:30:50 +02:00

vmwgfx_marker.c

drm: vmwgfx: Use nsec based interfaces

2014-07-23 15:01:50 -07:00

vmwgfx_mob.c

drm/ttm: remove use_ticket parameter from ttm_bo_reserve

2016-05-04 20:21:21 -04:00

vmwgfx_msg.c

drm/vmwgfx: Add a check to handle host message failure

2016-07-01 10:47:47 -07:00

vmwgfx_msg.h

drm/vmwgfx: Fix 32-bit VMW_PORT_HB_[IN|OUT] macros

2018-05-30 07:50:17 +02:00

vmwgfx_overlay.c

drm/vmwgfx: Fix up user_dmabuf refcounting

2015-09-14 01:13:11 -07:00

vmwgfx_prime.c

drm/vmwgfx: Hook up the prime ioctls

2013-11-18 04:11:53 -08:00

vmwgfx_reg.h

drm/vmwgfx: Fix copyright headers

2015-08-12 10:06:56 -07:00

vmwgfx_resource_priv.h

drm/vmwgfx: Fix copyright headers

2015-08-12 10:06:56 -07:00

vmwgfx_resource.c

drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces

2017-04-12 12:41:10 +02:00

vmwgfx_scrn.c

drm/vmwgfx: Fix a destoy-while-held mutex problem.

2018-03-28 18:39:22 +02:00

vmwgfx_shader.c

drm/ttm: remove use_ticket parameter from ttm_bo_reserve

2016-05-04 20:21:21 -04:00

vmwgfx_so.c

drm/vmwgfx: Fix copyright headers

2015-08-12 10:06:56 -07:00

vmwgfx_so.h

drm/vmwgfx: Fix copyright headers

2015-08-12 10:06:56 -07:00

vmwgfx_stdu.c

drm/vmwgfx: Fix a destoy-while-held mutex problem.

2018-03-28 18:39:22 +02:00

vmwgfx_surface.c

drm/vmwgfx: Make sure backup_handle is always valid

2017-06-14 15:06:04 +02:00

vmwgfx_ttm_glue.c

drm/vmwgfx: Fix copyright headers

2015-08-12 10:06:56 -07:00