From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Herrmann Subject: [PATCH 6/7] drm/crtc: add sanity checks to create_dumb() Date: Mon, 20 Jan 2014 20:26:28 +0100 Message-ID: <1390245989-13280-6-git-send-email-dh.herrmann@gmail.com> References: <1390245989-13280-1-git-send-email-dh.herrmann@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail-bk0-f46.google.com (mail-bk0-f46.google.com [209.85.214.46]) by gabe.freedesktop.org (Postfix) with ESMTP id F3A82FAC2E for ; Mon, 20 Jan 2014 11:26:56 -0800 (PST) Received: by mail-bk0-f46.google.com with SMTP id r7so670655bkg.19 for ; Mon, 20 Jan 2014 11:26:56 -0800 (PST) In-Reply-To: <1390245989-13280-1-git-send-email-dh.herrmann@gmail.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces@lists.freedesktop.org Errors-To: dri-devel-bounces@lists.freedesktop.org To: dri-devel@lists.freedesktop.org Cc: Daniel Vetter List-Id: dri-devel@lists.freedesktop.org Lets make sure some basic expressions are always true: bpp != NULL width != NULL height != NULL stride = bpp * width < 2^32 size = stride * height < 2^32 PAGE_ALIGN(size) < 2^32 At least the udl driver doesn't check for multiplication-overflows, so lets just make sure it will never happen. These checks allow drivers to do any 32bit math without having to test for mult-overflows themselves. The two divisions might hurt performance a bit, but dumb_create() is only used for scanout-buffers, so that should be fine. We could use 64bit math to avoid the divisions, but that may be slow on 32bit machines.. Or maybe there should just be a "safe_mult32()" helper, which currently doesn't exist (I think?). Signed-off-by: David Herrmann --- drivers/gpu/drm/drm_crtc.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index 266a01d..ff647fa 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -3738,9 +3738,24 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv) { struct drm_mode_create_dumb *args = data; + u32 Bpp, stride, size; if (!dev->driver->dumb_create) return -ENOSYS; + if (!args->width || !args->height || !args->bpp) + return -EINVAL; + + /* overflow checks for 32bit size calculations */ + Bpp = (args->bpp + 7) / 8; + if (Bpp > 0xffffffffU / args->width) + return -EINVAL; + stride = Bpp * args->width; + if (args->height > 0xffffffffU / stride) + return -EINVAL; + size = args->height * stride; + if (PAGE_ALIGN(size) < size) + return -EINVAL; + return dev->driver->dumb_create(file_priv, dev, args); } -- 1.8.5.3