Re: [PATCH 1/2] drm/i915: Don't clobber the addfb2 ioctl params

["Ville Syrjälä" <ville.syrjala@linux.intel.com>]

On Tue, Nov 17, 2015 at 10:47:06AM +0100, Daniel Vetter wrote:
> On Wed, Nov 11, 2015 at 07:11:28PM +0200, ville.syrjala@linux.intel.com wrote:
> > From: Ville Syrj�l� <ville.syrjala@linux.intel.com>
> > 
> > We try to convert the old way of of specifying fb tiling (obj->tiling)
> > into the new fb modifiers. We store the result in the passed in mode_cmd
> > structure. But that structure comes directly from the addfb2 ioctl, and
> > gets copied back out to userspace, which means we're clobbering the
> > modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIFIERS
> > flag wasn't even set by the user). Hence if the user reuses the struct
> > for another addfb2, the ioctl will be rejected since it's now asking for
> > some modifiers w/o the flag set.
> > 
> > Fix the problem by making a copy of the user provided structure. We can
> > play any games we want with the copy.
> > 
> > Cc: stable@vger.kernel.org
> > Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> > Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> > Fixes: 2a80eada326f ("drm/i915: Add fb format modifier support")
> > Testcase: igt/kms_addfb_basic/clobbered-modifier
> > Signed-off-by: Ville Syrj�l� <ville.syrjala@linux.intel.com>
> 
> Out of curiosity: Where does this blow up? That should be added to the
> commit message (so that people affected can match it up with this fix).

I don't know that it affects any actual users. The way I caught this was
running kms_addfb_basic. One of the subtests failed when I ran the full
test, but if I ran only the specific subtest it was fine. So the
modifiers got clobbered by the previous subtest. I already forgot which
subtest it was, but it's easy enough to track it down again.

> With that:
> 
> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> 
> 
> > ---
> >  drivers/gpu/drm/i915/intel_display.c | 7 ++++---
> >  1 file changed, 4 insertions(+), 3 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
> > index b5f7493..c3aa6f5 100644
> > --- a/drivers/gpu/drm/i915/intel_display.c
> > +++ b/drivers/gpu/drm/i915/intel_display.c
> > @@ -14578,17 +14578,18 @@ static int intel_framebuffer_init(struct drm_device *dev,
> >  static struct drm_framebuffer *
> >  intel_user_framebuffer_create(struct drm_device *dev,
> >  			      struct drm_file *filp,
> > -			      struct drm_mode_fb_cmd2 *mode_cmd)
> > +			      struct drm_mode_fb_cmd2 *user_mode_cmd)
> >  {
> >  	struct drm_framebuffer *fb;
> >  	struct drm_i915_gem_object *obj;
> > +	struct drm_mode_fb_cmd2 mode_cmd = *user_mode_cmd;
> >  
> >  	obj = to_intel_bo(drm_gem_object_lookup(dev, filp,
> > -						mode_cmd->handles[0]));
> > +						mode_cmd.handles[0]));
> >  	if (&obj->base == NULL)
> >  		return ERR_PTR(-ENOENT);
> >  
> > -	fb = intel_framebuffer_create(dev, mode_cmd, obj);
> > +	fb = intel_framebuffer_create(dev, &mode_cmd, obj);
> >  	if (IS_ERR(fb))
> >  		drm_gem_object_unreference_unlocked(&obj->base);
> >  
> > -- 
> > 2.4.10
> > 
> 
> -- 
> Daniel Vetter
> Software Engineer, Intel Corporation
> http://blog.ffwll.ch

-- 
Ville Syrj�l�
Intel OTC