drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces

commit fe25deb7737ce6c0879ccf79c99fa1221d428bf2 upstream.

Previously, when a surface was opened using a legacy (non prime) handle,
it was verified to have been created by a client in the same master realm.
Relax this so that opening is also allowed recursively if the client
already has the surface open.

This works around a regression in svga mesa where opening of a shared
surface is used recursively to obtain surface information.

Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 7 insertions, 3 deletions

diff --git a/drivers/gpu/drm/ttm/ttm_object.c b/drivers/gpu/drm/ttm/ttm_object.c
index 4f5fa8d65fe9..144367c0c28f 100644
--- a/drivers/gpu/drm/ttm/ttm_object.c
+++ b/drivers/gpu/drm/ttm/ttm_object.c
@@ -179,7 +179,7 @@ int ttm_base_object_init(struct ttm_object_file *tfile,
         if (unlikely(ret != 0))
                 goto out_err0;
 
-        ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+        ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL, false);
         if (unlikely(ret != 0))
                 goto out_err1;
 
@@ -318,7 +318,8 @@ EXPORT_SYMBOL(ttm_ref_object_exists);
 
 int ttm_ref_object_add(struct ttm_object_file *tfile,
                        struct ttm_base_object *base,
-                       enum ttm_ref_type ref_type, bool *existed)
+                       enum ttm_ref_type ref_type, bool *existed,
+                       bool require_existed)
 {
         struct drm_open_hash *ht = &tfile->ref_hash[ref_type];
         struct ttm_ref_object *ref;
@@ -345,6 +346,9 @@ int ttm_ref_object_add(struct ttm_object_file *tfile,
                 }
 
                 rcu_read_unlock();
+                if (require_existed)
+                        return -EPERM;
+
                 ret = ttm_mem_global_alloc(mem_glob, sizeof(*ref),
                                            false, false);
                 if (unlikely(ret != 0))
@@ -635,7 +639,7 @@ int ttm_prime_fd_to_handle(struct ttm_object_file *tfile,
         prime = (struct ttm_prime_object *) dma_buf->priv;
         base = &prime->base;
         *handle = base->hash.key;
-        ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+        ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL, false);
 
         dma_buf_put(dma_buf);