Fix rhbz 1565354

3 files changed, 188 insertions, 0 deletions

diff --git a/0001-qxl-fix-qxl_release_-map-unmap.patch b/0001-qxl-fix-qxl_release_-map-unmap.patch
new file mode 100644
index 000000000..952dbfa16
--- /dev/null
+++ b/0001-qxl-fix-qxl_release_-map-unmap.patch
@@ -0,0 +1,61 @@
+From aabf8665c5e88deefe8b27898bad089b67f8b08a Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 17 Apr 2018 09:11:12 +0200
+Subject: [PATCH 1/2] qxl: fix qxl_release_{map,unmap}
+
+s/PAGE_SIZE/PAGE_MASK/
+
+Luckily release_offset is never larger than PAGE_SIZE, so the bug has no
+bad side effects and managed to stay unnoticed for years that way ...
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ drivers/gpu/drm/qxl/qxl_ioctl.c   | 4 ++--
+ drivers/gpu/drm/qxl/qxl_release.c | 6 +++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
+index e8c0b10372..ae37cfc56b 100644
+--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
++++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
+@@ -182,9 +182,9 @@ static int qxl_process_single_command(struct qxl_device *qdev,
+ 		goto out_free_reloc;
+ 
+ 	/* TODO copy slow path code from i915 */
+-	fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE));
++	fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_MASK));
+ 	unwritten = __copy_from_user_inatomic_nocache
+-		(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE),
++		(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_MASK),
+ 		 u64_to_user_ptr(cmd->command), cmd->command_size);
+ 
+ 	{
+diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c
+index b223c8d0a4..91a10459da 100644
+--- a/drivers/gpu/drm/qxl/qxl_release.c
++++ b/drivers/gpu/drm/qxl/qxl_release.c
+@@ -411,10 +411,10 @@ union qxl_release_info *qxl_release_map(struct qxl_device *qdev,
+ 	struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
+ 	struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
+ 
+-	ptr = qxl_bo_kmap_atomic_page(qdev, bo, release->release_offset & PAGE_SIZE);
++	ptr = qxl_bo_kmap_atomic_page(qdev, bo, release->release_offset & PAGE_MASK);
+ 	if (!ptr)
+ 		return NULL;
+-	info = ptr + (release->release_offset & ~PAGE_SIZE);
++	info = ptr + (release->release_offset & ~PAGE_MASK);
+ 	return info;
+ }
+ 
+@@ -426,7 +426,7 @@ void qxl_release_unmap(struct qxl_device *qdev,
+ 	struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
+ 	void *ptr;
+ 
+-	ptr = ((void *)info) - (release->release_offset & ~PAGE_SIZE);
++	ptr = ((void *)info) - (release->release_offset & ~PAGE_MASK);
+ 	qxl_bo_kunmap_atomic_page(qdev, bo, ptr);
+ }
+ 
+-- 
+2.9.3
+
diff --git a/0002-qxl-keep-separate-release_bo-pointer.patch b/0002-qxl-keep-separate-release_bo-pointer.patch
new file mode 100644
index 000000000..66b4bdb2d
--- /dev/null
+++ b/0002-qxl-keep-separate-release_bo-pointer.patch
@@ -0,0 +1,120 @@
+From 0e305b67752775d6f47b2730bfba5bc77ac81f16 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 17 Apr 2018 22:36:48 +0200
+Subject: [PATCH 2/2] qxl: keep separate release_bo pointer
+
+qxl expects that list_first_entry(release->bos) returns the first
+element qxl added to the list.  ttm_eu_reserve_buffers() may reorder
+the list though.
+
+Add a release_bo field to struct qxl_release and use that instead.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ drivers/gpu/drm/qxl/qxl_drv.h     |  1 +
+ drivers/gpu/drm/qxl/qxl_cmd.c     |  6 ++----
+ drivers/gpu/drm/qxl/qxl_release.c | 12 ++++++------
+ 3 files changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
+index 00a1a66b05..864b456080 100644
+--- a/drivers/gpu/drm/qxl/qxl_drv.h
++++ b/drivers/gpu/drm/qxl/qxl_drv.h
+@@ -167,6 +167,7 @@ struct qxl_release {
+ 
+ 	int id;
+ 	int type;
++	struct qxl_bo *release_bo;
+ 	uint32_t release_offset;
+ 	uint32_t surface_release_id;
+ 	struct ww_acquire_ctx ticket;
+diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
+index c0fb52c6d4..01665b98c5 100644
+--- a/drivers/gpu/drm/qxl/qxl_cmd.c
++++ b/drivers/gpu/drm/qxl/qxl_cmd.c
+@@ -179,10 +179,9 @@ qxl_push_command_ring_release(struct qxl_device *qdev, struct qxl_release *relea
+ 			      uint32_t type, bool interruptible)
+ {
+ 	struct qxl_command cmd;
+-	struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
+ 
+ 	cmd.type = type;
+-	cmd.data = qxl_bo_physical_address(qdev, to_qxl_bo(entry->tv.bo), release->release_offset);
++	cmd.data = qxl_bo_physical_address(qdev, release->release_bo, release->release_offset);
+ 
+ 	return qxl_ring_push(qdev->command_ring, &cmd, interruptible);
+ }
+@@ -192,10 +191,9 @@ qxl_push_cursor_ring_release(struct qxl_device *qdev, struct qxl_release *releas
+ 			     uint32_t type, bool interruptible)
+ {
+ 	struct qxl_command cmd;
+-	struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
+ 
+ 	cmd.type = type;
+-	cmd.data = qxl_bo_physical_address(qdev, to_qxl_bo(entry->tv.bo), release->release_offset);
++	cmd.data = qxl_bo_physical_address(qdev, release->release_bo, release->release_offset);
+ 
+ 	return qxl_ring_push(qdev->cursor_ring, &cmd, interruptible);
+ }
+diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c
+index 91a10459da..7c11855b74 100644
+--- a/drivers/gpu/drm/qxl/qxl_release.c
++++ b/drivers/gpu/drm/qxl/qxl_release.c
+@@ -173,6 +173,7 @@ qxl_release_free_list(struct qxl_release *release)
+ 		list_del(&entry->tv.head);
+ 		kfree(entry);
+ 	}
++	release->release_bo = NULL;
+ }
+ 
+ void
+@@ -296,7 +297,6 @@ int qxl_alloc_surface_release_reserved(struct qxl_device *qdev,
+ {
+ 	if (surface_cmd_type == QXL_SURFACE_CMD_DESTROY && create_rel) {
+ 		int idr_ret;
+-		struct qxl_bo_list *entry = list_first_entry(&create_rel->bos, struct qxl_bo_list, tv.head);
+ 		struct qxl_bo *bo;
+ 		union qxl_release_info *info;
+ 
+@@ -304,8 +304,9 @@ int qxl_alloc_surface_release_reserved(struct qxl_device *qdev,
+ 		idr_ret = qxl_release_alloc(qdev, QXL_RELEASE_SURFACE_CMD, release);
+ 		if (idr_ret < 0)
+ 			return idr_ret;
+-		bo = to_qxl_bo(entry->tv.bo);
++		bo = create_rel->release_bo;
+ 
++		(*release)->release_bo = bo;
+ 		(*release)->release_offset = create_rel->release_offset + 64;
+ 
+ 		qxl_release_list_add(*release, bo);
+@@ -365,6 +366,7 @@ int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
+ 
+ 	bo = qxl_bo_ref(qdev->current_release_bo[cur_idx]);
+ 
++	(*release)->release_bo = bo;
+ 	(*release)->release_offset = qdev->current_release_bo_offset[cur_idx] * release_size_per_bo[cur_idx];
+ 	qdev->current_release_bo_offset[cur_idx]++;
+ 
+@@ -408,8 +410,7 @@ union qxl_release_info *qxl_release_map(struct qxl_device *qdev,
+ {
+ 	void *ptr;
+ 	union qxl_release_info *info;
+-	struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
+-	struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
++	struct qxl_bo *bo = release->release_bo;
+ 
+ 	ptr = qxl_bo_kmap_atomic_page(qdev, bo, release->release_offset & PAGE_MASK);
+ 	if (!ptr)
+@@ -422,8 +423,7 @@ void qxl_release_unmap(struct qxl_device *qdev,
+ 		       struct qxl_release *release,
+ 		       union qxl_release_info *info)
+ {
+-	struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
+-	struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
++	struct qxl_bo *bo = release->release_bo;
+ 	void *ptr;
+ 
+ 	ptr = ((void *)info) - (release->release_offset & ~PAGE_MASK);
+-- 
+2.9.3
+
diff --git a/kernel.spec b/kernel.spec
index f3780020a..0820c46e2 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -617,6 +617,10 @@ Patch503: v3-2-2-Input-synaptics---Lenovo-X1-Carbon-5-should-use-SMBUS-RMI.patch
 # Drop this when configs are updated
 Patch504: 0001-Back-out-Kconfig.patch
 
+# rhbz 1565354
+Patch505: 0001-qxl-fix-qxl_release_-map-unmap.patch
+Patch506: 0002-qxl-keep-separate-release_bo-pointer.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1865,6 +1869,9 @@ fi
 #
 #
 %changelog
+* Wed Apr 18 2018 Justin M. Forbes <jforbes@fedoraproject.org>
+- Fix rhbz 1565354
+
 * Tue Apr 17 2018 Peter Robinson <pbrobinson@fedoraproject.org>
 - Enable drivers for Xilinx ZYMQ-MP Ultra96
 - Initial support for PocketBeagle