public inbox for intel-gfx@lists.freedesktop.org
 help / color / mirror / Atom feed
* [PATCH] drm: Add integer overflow checking to transitional plane helpers
@ 2015-04-03 21:27 Matt Roper
  2015-04-03 23:58 ` shuang.he
  2015-04-07  6:12 ` Daniel Vetter
  0 siblings, 2 replies; 6+ messages in thread
From: Matt Roper @ 2015-04-03 21:27 UTC (permalink / raw)
  To: dri-devel; +Cc: intel-gfx

Add tests for destination rectangle integer overflow before calling the
driver's check function.  This will ensure that the transitional plane
helpers match the behavior of the full atomic helpers by always
returning -ERANGE for planes positioned beyond INT_MAX.

Note that the legacy SetPlane ioctl itself also includes similar tests
for integer overflow, so the only case where this check really matters
is when legacy cursor operations get routed through the universal plane
interface internally.

This issue was first noticed with i915 commit:

        commit ff42e093e9c9c17a6e1d6aab24875a36795f926e
        Author: Daniel Vetter <daniel.vetter@ffwll.ch>
        Date:   Mon Mar 2 16:35:20 2015 +0100

            Revert "drm/i915: Switch planes from transitional helpers to full
            atomic helpers"

The above revert switched us from full atomic helpers back to the
transitional helpers, and in doing so we lost the overflow checking here
for universal cursor updates.  Even though such extreme cursor positions
are unlikely to actually happen in the wild, we still don't want there
to be a change of behavior when drivers switch from transitional helpers
to full helpers.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=84269
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
---
 drivers/gpu/drm/drm_plane_helper.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/gpu/drm/drm_plane_helper.c b/drivers/gpu/drm/drm_plane_helper.c
index 33807e0..1e9e105 100644
--- a/drivers/gpu/drm/drm_plane_helper.c
+++ b/drivers/gpu/drm/drm_plane_helper.c
@@ -417,6 +417,20 @@ int drm_plane_helper_commit(struct drm_plane *plane,
 	for (i = 0; i < 2; i++)
 		crtc_funcs[i] = crtc[i] ? crtc[i]->helper_private : NULL;
 
+	/*
+	 * Give drivers some help against integer overflows (and match the
+	 * behavior of the full atomic helpers).
+	 */
+	if (plane_state->crtc_w > INT_MAX ||
+	    plane_state->crtc_x > INT_MAX - (int32_t) plane_state->crtc_w ||
+	    plane_state->crtc_h > INT_MAX ||
+	    plane_state->crtc_y > INT_MAX - (int32_t) plane_state->crtc_h) {
+		DRM_DEBUG_ATOMIC("Invalid CRTC coordinates %ux%u+%d+%d\n",
+				 plane_state->crtc_w, plane_state->crtc_h,
+				 plane_state->crtc_x, plane_state->crtc_y);
+		return -ERANGE;
+	}
+
 	if (plane_funcs->atomic_check) {
 		ret = plane_funcs->atomic_check(plane, plane_state);
 		if (ret)
-- 
1.8.5.1

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply related	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-04-14  7:06 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-04-03 21:27 [PATCH] drm: Add integer overflow checking to transitional plane helpers Matt Roper
2015-04-03 23:58 ` shuang.he
2015-04-07  6:12 ` Daniel Vetter
2015-04-13 18:06   ` [PATCH] drm: Make integer overflow checking cover universal cursor updates (v2) Matt Roper
2015-04-13 20:45     ` shuang.he
2015-04-14  7:08     ` Daniel Vetter

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox