From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ville =?iso-8859-1?Q?Syrj=E4l=E4?= Subject: Re: [PATCH 1/2] drm/i915: Don't clobber the addfb2 ioctl params Date: Tue, 17 Nov 2015 13:04:21 +0200 Message-ID: <20151117110421.GQ4437@intel.com> References: <1447261890-3960-1-git-send-email-ville.syrjala@linux.intel.com> <20151117094706.GH16848@phenom.ffwll.local> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: Content-Disposition: inline In-Reply-To: <20151117094706.GH16848@phenom.ffwll.local> Sender: stable-owner@vger.kernel.org To: Daniel Vetter Cc: intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, stable@vger.kernel.org, Daniel Vetter , Tvrtko Ursulin , Jani Nikula List-Id: intel-gfx@lists.freedesktop.org On Tue, Nov 17, 2015 at 10:47:06AM +0100, Daniel Vetter wrote: > On Wed, Nov 11, 2015 at 07:11:28PM +0200, ville.syrjala@linux.intel.c= om wrote: > > From: Ville Syrj=E4l=E4 > >=20 > > We try to convert the old way of of specifying fb tiling (obj->tili= ng) > > into the new fb modifiers. We store the result in the passed in mod= e_cmd > > structure. But that structure comes directly from the addfb2 ioctl,= and > > gets copied back out to userspace, which means we're clobbering the > > modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIF= IERS > > flag wasn't even set by the user). Hence if the user reuses the str= uct > > for another addfb2, the ioctl will be rejected since it's now askin= g for > > some modifiers w/o the flag set. > >=20 > > Fix the problem by making a copy of the user provided structure. We= can > > play any games we want with the copy. > >=20 > > Cc: stable@vger.kernel.org > > Cc: Daniel Vetter > > Cc: Tvrtko Ursulin > > Fixes: 2a80eada326f ("drm/i915: Add fb format modifier support") > > Testcase: igt/kms_addfb_basic/clobbered-modifier > > Signed-off-by: Ville Syrj=E4l=E4 >=20 > Out of curiosity: Where does this blow up? That should be added to th= e > commit message (so that people affected can match it up with this fix= ). I don't know that it affects any actual users. The way I caught this wa= s running kms_addfb_basic. One of the subtests failed when I ran the full test, but if I ran only the specific subtest it was fine. So the modifiers got clobbered by the previous subtest. I already forgot which subtest it was, but it's easy enough to track it down again. > With that: >=20 > Reviewed-by: Daniel Vetter >=20 >=20 > > --- > > drivers/gpu/drm/i915/intel_display.c | 7 ++++--- > > 1 file changed, 4 insertions(+), 3 deletions(-) > >=20 > > diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm= /i915/intel_display.c > > index b5f7493..c3aa6f5 100644 > > --- a/drivers/gpu/drm/i915/intel_display.c > > +++ b/drivers/gpu/drm/i915/intel_display.c > > @@ -14578,17 +14578,18 @@ static int intel_framebuffer_init(struct = drm_device *dev, > > static struct drm_framebuffer * > > intel_user_framebuffer_create(struct drm_device *dev, > > struct drm_file *filp, > > - struct drm_mode_fb_cmd2 *mode_cmd) > > + struct drm_mode_fb_cmd2 *user_mode_cmd) > > { > > struct drm_framebuffer *fb; > > struct drm_i915_gem_object *obj; > > + struct drm_mode_fb_cmd2 mode_cmd =3D *user_mode_cmd; > > =20 > > obj =3D to_intel_bo(drm_gem_object_lookup(dev, filp, > > - mode_cmd->handles[0])); > > + mode_cmd.handles[0])); > > if (&obj->base =3D=3D NULL) > > return ERR_PTR(-ENOENT); > > =20 > > - fb =3D intel_framebuffer_create(dev, mode_cmd, obj); > > + fb =3D intel_framebuffer_create(dev, &mode_cmd, obj); > > if (IS_ERR(fb)) > > drm_gem_object_unreference_unlocked(&obj->base); > > =20 > > --=20 > > 2.4.10 > >=20 >=20 > --=20 > Daniel Vetter > Software Engineer, Intel Corporation > http://blog.ffwll.ch --=20 Ville Syrj=E4l=E4 Intel OTC