From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jesse Barnes Subject: Re: [PATCH 5/7] drm: plane: Check crtc coodrinates against integer overflows in setplane ioctl Date: Fri, 11 Nov 2011 09:01:46 -0800 Message-ID: <20111111090146.53157706@jbarnes-desktop> References: <1321027447-17921-1-git-send-email-ville.syrjala@linux.intel.com> <1321027447-17921-6-git-send-email-ville.syrjala@linux.intel.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1220897214==" Return-path: Received: from oproxy5-pub.bluehost.com (oproxy5-pub.bluehost.com [67.222.38.55]) by gabe.freedesktop.org (Postfix) with SMTP id 590839E9C0 for ; Fri, 11 Nov 2011 09:01:27 -0800 (PST) In-Reply-To: <1321027447-17921-6-git-send-email-ville.syrjala@linux.intel.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org Errors-To: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org To: ville.syrjala@linux.intel.com Cc: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============1220897214== Content-Type: multipart/signed; micalg=PGP-SHA1; boundary="Sig_/WuuGgIs95RMCuukL++Qt4Ap"; protocol="application/pgp-signature" --Sig_/WuuGgIs95RMCuukL++Qt4Ap Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On Fri, 11 Nov 2011 18:04:05 +0200 ville.syrjala@linux.intel.com wrote: > From: Ville Syrj=E4l=E4 >=20 > Help drivers a little by guaranteeing that crtc_x+crtc_w and > crtc_y+crtc_h don't overflow. >=20 > Signed-off-by: Ville Syrj=E4l=E4 > --- > drivers/gpu/drm/drm_crtc.c | 12 ++++++++++++ > 1 files changed, 12 insertions(+), 0 deletions(-) >=20 > diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c > index 098cc50..2410a9a 100644 > --- a/drivers/gpu/drm/drm_crtc.c > +++ b/drivers/gpu/drm/drm_crtc.c > @@ -1725,6 +1725,18 @@ int drm_mode_setplane(struct drm_device *dev, void= *data, > goto out; > } > =20 > + /* Give drivers some help against integer overflows */ > + if (plane_req->crtc_w > INT_MAX || > + plane_req->crtc_x > INT_MAX - (int32_t) plane_req->crtc_w || > + plane_req->crtc_h > INT_MAX || > + plane_req->crtc_y > INT_MAX - (int32_t) plane_req->crtc_h) { > + DRM_DEBUG_KMS("Invalid CRTC coordinates %ux%u+%d+%d\n", > + plane_req->crtc_w, plane_req->crtc_h, > + plane_req->crtc_x, plane_req->crtc_y); > + ret =3D -EINVAL; > + goto out; > + } > + > ret =3D plane->funcs->update_plane(plane, crtc, fb, > plane_req->crtc_x, plane_req->crtc_y, > plane_req->crtc_w, plane_req->crtc_h, Not sure this helps much in practice, since the drivers will have to validate the target CRTC rect against the actual pipe dimensions anyway. But it doesn't hurt either, so: Acked-by: Jesse Barnes --=20 Jesse Barnes, Intel Open Source Technology Center --Sig_/WuuGgIs95RMCuukL++Qt4Ap Content-Type: application/pgp-signature; name=signature.asc Content-Disposition: attachment; filename=signature.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQIcBAEBAgAGBQJOvVT6AAoJEIEoDkX4Qk9h6CoP/A5iY3XOwwJyDRBmgtuLcr8o x6naorEfXMQahpq5pQtWY1TofeamgxCyryckC7OLL9IDMPJZ17jIy94fBJkUORRW o2rFTSLg966jhKLF7a7lH6zhf3YWqzvfab4eCw0UY4aMhicpLgqxIdCX4iOZkM4a x2WjASQJInjTF6zZtWUVP0DlwqdE2sDnqTKBRxSiRf9gJ1VzVSI1lqenIlpSSMOB MP07EtCPm7f9wJXJNl95nLs+QvYZ9c9ln1TkfLqLHozFOSSkBZY1OStvQH6w4dIz 38AD0kLxu4puuceJOoy8gsbZNKBldLi8xoEBrgUPtRMhsTKkFcaeKZXbzUhQfHXv mOuXavLhhZ0AsE/J79uVFgQPDRPpFfzt7R156xXjYj8csl60l7WwBCZ69sEzAuyZ iQlixNuovt2HeNw6usmcTFEzkYi81mIUUs0wO8KaN6eOF2684AjJAPguGajRu4zv UTQJtrPMVHbj6VCIA2rcnfuawhtsTuBDuiBFuBtkVXp2Ma/nbs9uvq8B3visfB30 UlmnvZ/uTeydGJqv1ulmCg+BBfafSh07L/QaRq+GyYV15lp3YzAp5P2UjEbpjV7c eCqkzRCJuBMrzNbgBBoGKaKH9NHImgg+LRizRlZI4zkwEJplk9ISTusxtkyGgDOd 5AarYyrMD2zregbeRwNE =xbrI -----END PGP SIGNATURE----- --Sig_/WuuGgIs95RMCuukL++Qt4Ap-- --===============1220897214== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel --===============1220897214==--