drm/vmwgfx: Fix compat mode shader operation

commit e41c20cf50a8a7d0dfa337a7530590aacef4193b upstream.

In compat mode, we allowed host-backed user-space with guest-backed
kernel / device. In this mode, set shader commands was broken since
no relocations were emitted. Fix this.

Cc: <stable@vger.kernel.org>
Fixes: e8c66efbfe3a ("drm/vmwgfx: Make user resource lookups reference-free during validation")
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 88b8178d4687116725902a9700e44a946ebf6583..c0231a817d3be177a9dec6ef2790aaec7e442751 100644 (file)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -2129,6 +2129,11 @@ static int vmw_cmd_set_shader(struct vmw_private *dev_priv,
                return 0;
 
        if (cmd->body.shid != SVGA3D_INVALID_ID) {
+               /*
+                * This is the compat shader path - Per device guest-backed
+                * shaders, but user-space thinks it's per context host-
+                * backed shaders.
+                */
                res = vmw_shader_lookup(vmw_context_res_man(ctx),
                                        cmd->body.shid,
                                        cmd->body.type);
@@ -2137,6 +2142,14 @@ static int vmw_cmd_set_shader(struct vmw_private *dev_priv,
                        ret = vmw_execbuf_res_noctx_val_add(sw_context, res);
                        if (unlikely(ret != 0))
                                return ret;
+
+                       ret = vmw_resource_relocation_add
+                               (sw_context, res,
+                                vmw_ptr_diff(sw_context->buf_start,
+                                             &cmd->body.shid),
+                                vmw_res_rel_normal);
+                       if (unlikely(ret != 0))
+                               return ret;
                }
        }