From eec7e23d848d2194dd8791fcd0f4a54d4378eecd Mon Sep 17 00:00:00 2001 From: Akash Goel Date: Thu, 27 Nov 2025 16:49:12 +0000 Subject: [PATCH 1/4] drm/panthor: Prevent potential UAF in group creation This commit prevents the possibility of a use after free issue in the GROUP_CREATE ioctl function, which arose as pointer to the group is accessed in that ioctl function after storing it in the Xarray. A malicious userspace can second guess the handle of a group and try to call GROUP_DESTROY ioctl from another thread around the same time as GROUP_CREATE ioctl. To prevent the use after free exploit, this commit uses a mark on an entry of group pool Xarray which is added just before returning from the GROUP_CREATE ioctl function. The mark is checked for all ioctls that specify the group handle and so userspace won't be abe to delete a group that isn't marked yet. v2: Add R-bs and fixes tags Fixes: de85488138247 ("drm/panthor: Add the scheduler logical block") Co-developed-by: Boris Brezillon Signed-off-by: Boris Brezillon Signed-off-by: Akash Goel Reviewed-by: Boris Brezillon Reviewed-by: Steven Price Reviewed-by: Chia-I Wu Link: https://patch.msgid.link/20251127164912.3788155-1-akash.goel@arm.com --- drivers/gpu/drm/panthor/panthor_sched.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c index e74ca071159d..5d2e9144d450 100644 --- a/drivers/gpu/drm/panthor/panthor_sched.c +++ b/drivers/gpu/drm/panthor/panthor_sched.c @@ -776,6 +776,12 @@ struct panthor_job_profiling_data { */ #define MAX_GROUPS_PER_POOL 128 +/* + * Mark added on an entry of group pool Xarray to identify if the group has + * been fully initialized and can be accessed elsewhere in the driver code. + */ +#define GROUP_REGISTERED XA_MARK_1 + /** * struct panthor_group_pool - Group pool * @@ -2906,7 +2912,7 @@ void panthor_fdinfo_gather_group_samples(struct panthor_file *pfile) return; xa_lock(&gpool->xa); - xa_for_each(&gpool->xa, i, group) { + xa_for_each_marked(&gpool->xa, i, group, GROUP_REGISTERED) { guard(spinlock)(&group->fdinfo.lock); pfile->stats.cycles += group->fdinfo.data.cycles; pfile->stats.time += group->fdinfo.data.time; @@ -3591,6 +3597,8 @@ int panthor_group_create(struct panthor_file *pfile, group_init_task_info(group); + xa_set_mark(&gpool->xa, gid, GROUP_REGISTERED); + return gid; err_erase_gid: @@ -3608,6 +3616,9 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle) struct panthor_scheduler *sched = ptdev->scheduler; struct panthor_group *group; + if (!xa_get_mark(&gpool->xa, group_handle, GROUP_REGISTERED)) + return -EINVAL; + group = xa_erase(&gpool->xa, group_handle); if (!group) return -EINVAL; @@ -3633,12 +3644,12 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle) } static struct panthor_group *group_from_handle(struct panthor_group_pool *pool, - u32 group_handle) + unsigned long group_handle) { struct panthor_group *group; xa_lock(&pool->xa); - group = group_get(xa_load(&pool->xa, group_handle)); + group = group_get(xa_find(&pool->xa, &group_handle, group_handle, GROUP_REGISTERED)); xa_unlock(&pool->xa); return group; @@ -3725,7 +3736,7 @@ panthor_fdinfo_gather_group_mem_info(struct panthor_file *pfile, return; xa_lock(&gpool->xa); - xa_for_each(&gpool->xa, i, group) { + xa_for_each_marked(&gpool->xa, i, group, GROUP_REGISTERED) { stats->resident += group->fdinfo.kbo_sizes; if (group->csg_id >= 0) stats->active += group->fdinfo.kbo_sizes; From 56715b45e3bfecf82e6404df19a10699a67c3a74 Mon Sep 17 00:00:00 2001 From: Ludovic Desroches Date: Wed, 26 Nov 2025 15:44:44 +0100 Subject: [PATCH 2/4] drm/gem-dma: revert the 8-byte alignment constraint MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Using drm_mode_size_dumb() to compute the size of dumb buffers introduced an 8-byte alignment constraint on the pitch that wasn’t present before. Let’s remove this constraint, which isn’t necessarily required and may cause buffers to be allocated larger than needed. Signed-off-by: Ludovic Desroches Reviewed-by: Thomas Zimmermann Fixes: dcacfcd35cef ("drm/gem-dma: Compute dumb-buffer sizes with drm_mode_size_dumb()") Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20251126-lcd_pitch_alignment-v1-1-991610a1e369@microchip.com --- drivers/gpu/drm/drm_gem_dma_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_gem_dma_helper.c b/drivers/gpu/drm/drm_gem_dma_helper.c index 12d8307997a0..eb56ba234796 100644 --- a/drivers/gpu/drm/drm_gem_dma_helper.c +++ b/drivers/gpu/drm/drm_gem_dma_helper.c @@ -308,7 +308,7 @@ int drm_gem_dma_dumb_create(struct drm_file *file_priv, struct drm_gem_dma_object *dma_obj; int ret; - ret = drm_mode_size_dumb(drm, args, SZ_8, 0); + ret = drm_mode_size_dumb(drm, args, 0, 0); if (ret) return ret; From 4cbae3748fc479f1944e8ef2b3ed4a05cd799ce8 Mon Sep 17 00:00:00 2001 From: Ludovic Desroches Date: Wed, 26 Nov 2025 15:44:45 +0100 Subject: [PATCH 3/4] drm/gem-shmem: revert the 8-byte alignment constraint MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Using drm_mode_size_dumb() to compute the size of dumb buffers introduced an 8-byte alignment constraint on the pitch that wasn’t present before. Let’s remove this constraint, which isn’t necessarily required and may cause buffers to be allocated larger than needed. Signed-off-by: Ludovic Desroches Reviewed-by: Thomas Zimmermann Fixes: 4977dcecb931 ("drm/gem-shmem: Compute dumb-buffer sizes with drm_mode_size_dumb()") Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20251126-lcd_pitch_alignment-v1-2-991610a1e369@microchip.com --- drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index dc94a27710e5..93b9cff89080 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -559,7 +559,7 @@ int drm_gem_shmem_dumb_create(struct drm_file *file, struct drm_device *dev, { int ret; - ret = drm_mode_size_dumb(dev, args, SZ_8, 0); + ret = drm_mode_size_dumb(dev, args, 0, 0); if (ret) return ret; From 308eeb8ca3fdee54bcd3ec7272c05688e178299a Mon Sep 17 00:00:00 2001 From: Marek Vasut Date: Tue, 2 Dec 2025 19:11:06 +0100 Subject: [PATCH 4/4] drm/rcar-du: dsi: Handle both DRM_MODE_FLAG_N.SYNC and !DRM_MODE_FLAG_P.SYNC Since commit 94fe479fae96 ("drm/rcar-du: dsi: Clean up handling of DRM mode flags") the driver does not set TXVMVPRMSET0R_VSPOL_LOW and TXVMVPRMSET0R_HSPOL_LOW for modes which set neither DRM_MODE_FLAG_[PN].SYNC. The previous behavior was to assume that neither flag means DRM_MODE_FLAG_N.SYNC . Restore the previous behavior for maximum compatibility. The change of behavior is visible below, consider Vertical mode->flags for simplicity sake, although the same applies to Horizontal ones: Before 94fe479fae96 ("drm/rcar-du: dsi: Clean up handling of DRM mode flags") : - DRM_MODE_FLAG_PVSYNC => vprmset0r |= 0 - DRM_MODE_FLAG_NVSYNC => vprmset0r |= TXVMVPRMSET0R_VSPOL_LOW - Neither DRM_MODE_FLAG_[PN]VSYNC => vprmset0r |= TXVMVPRMSET0R_VSPOL_LOW After 94fe479fae96 ("drm/rcar-du: dsi: Clean up handling of DRM mode flags") : - DRM_MODE_FLAG_PVSYNC => vprmset0r |= 0 - DRM_MODE_FLAG_NVSYNC => vprmset0r |= TXVMVPRMSET0R_VSPOL_LOW - Neither DRM_MODE_FLAG_[PN]VSYNC => vprmset0r |= 0 <---------- This broke The "Neither" case behavior is different, because DRM_MODE_FLAG_N[HV]SYNC is really not equivalent !DRM_MODE_FLAG_P[HV]SYNC . Fixes: 94fe479fae96 ("drm/rcar-du: dsi: Clean up handling of DRM mode flags") Signed-off-by: Marek Vasut Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20251202181146.138365-1-marek.vasut+renesas@mailbox.org Signed-off-by: Tomi Valkeinen --- drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c index 9413b76d0bfc..4ef2e3c129ed 100644 --- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c +++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c @@ -492,9 +492,9 @@ static void rcar_mipi_dsi_set_display_timing(struct rcar_mipi_dsi *dsi, /* Configuration for Video Parameters, input is always RGB888 */ vprmset0r = TXVMVPRMSET0R_BPP_24; - if (mode->flags & DRM_MODE_FLAG_NVSYNC) + if (!(mode->flags & DRM_MODE_FLAG_PVSYNC)) vprmset0r |= TXVMVPRMSET0R_VSPOL_LOW; - if (mode->flags & DRM_MODE_FLAG_NHSYNC) + if (!(mode->flags & DRM_MODE_FLAG_PHSYNC)) vprmset0r |= TXVMVPRMSET0R_HSPOL_LOW; vprmset1r = TXVMVPRMSET1R_VACTIVE(mode->vdisplay)