[PATCH 1/2] drm/i915: Don't clobber the addfb2 ioctl params

[PATCH 1/2] drm/i915: Don't clobber the addfb2 ioctl params

[ville.syrjala]

From: Ville Syrjälä <ville.syrjala@linux.intel.com>

We try to convert the old way of of specifying fb tiling (obj->tiling)
into the new fb modifiers. We store the result in the passed in mode_cmd
structure. But that structure comes directly from the addfb2 ioctl, and
gets copied back out to userspace, which means we're clobbering the
modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIFIERS
flag wasn't even set by the user). Hence if the user reuses the struct
for another addfb2, the ioctl will be rejected since it's now asking for
some modifiers w/o the flag set.

Fix the problem by making a copy of the user provided structure. We can
play any games we want with the copy.

Cc: stable@vger.kernel.org
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Fixes: 2a80eada326f ("drm/i915: Add fb format modifier support")
Testcase: igt/kms_addfb_basic/clobbered-modifier
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
---
 drivers/gpu/drm/i915/intel_display.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index b5f7493..c3aa6f5 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -14578,17 +14578,18 @@ static int intel_framebuffer_init(struct drm_device *dev,
 static struct drm_framebuffer *
 intel_user_framebuffer_create(struct drm_device *dev,
 			      struct drm_file *filp,
-			      struct drm_mode_fb_cmd2 *mode_cmd)
+			      struct drm_mode_fb_cmd2 *user_mode_cmd)
 {
 	struct drm_framebuffer *fb;
 	struct drm_i915_gem_object *obj;
+	struct drm_mode_fb_cmd2 mode_cmd = *user_mode_cmd;
 
 	obj = to_intel_bo(drm_gem_object_lookup(dev, filp,
-						mode_cmd->handles[0]));
+						mode_cmd.handles[0]));
 	if (&obj->base == NULL)
 		return ERR_PTR(-ENOENT);
 
-	fb = intel_framebuffer_create(dev, mode_cmd, obj);
+	fb = intel_framebuffer_create(dev, &mode_cmd, obj);
 	if (IS_ERR(fb))
 		drm_gem_object_unreference_unlocked(&obj->base);
 
-- 
2.4.10

Re: [PATCH 1/2] drm/i915: Don't clobber the addfb2 ioctl params

[Chris Wilson]

On Wed, Nov 11, 2015 at 07:11:28PM +0200, ville.syrjala@linux.intel.com wrote:
> From: Ville Syrj�l� <ville.syrjala@linux.intel.com>
> 
> We try to convert the old way of of specifying fb tiling (obj->tiling)
> into the new fb modifiers. We store the result in the passed in mode_cmd
> structure. But that structure comes directly from the addfb2 ioctl, and
> gets copied back out to userspace, which means we're clobbering the
> modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIFIERS
> flag wasn't even set by the user). Hence if the user reuses the struct
> for another addfb2, the ioctl will be rejected since it's now asking for
> some modifiers w/o the flag set.

What do we actually pass back to userspace through the struct? Do we
just want to
-#define DRM_IOCTL_MODE_ADDFB2          DRM_IOWR(0xB8, struct drm_mode_fb_cmd2)
+#define DRM_IOCTL_MODE_ADDFB2          DRM_IOR(0xB8, struct drm_mode_fb_cmd2
instead?
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre

Re: [PATCH 1/2] drm/i915: Don't clobber the addfb2 ioctl params

[Ville Syrjälä]

On Wed, Nov 11, 2015 at 05:20:10PM +0000, Chris Wilson wrote:
> On Wed, Nov 11, 2015 at 07:11:28PM +0200, ville.syrjala@linux.intel.com wrote:
> > From: Ville Syrj�l� <ville.syrjala@linux.intel.com>
> > 
> > We try to convert the old way of of specifying fb tiling (obj->tiling)
> > into the new fb modifiers. We store the result in the passed in mode_cmd
> > structure. But that structure comes directly from the addfb2 ioctl, and
> > gets copied back out to userspace, which means we're clobbering the
> > modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIFIERS
> > flag wasn't even set by the user). Hence if the user reuses the struct
> > for another addfb2, the ioctl will be rejected since it's now asking for
> > some modifiers w/o the flag set.
> 
> What do we actually pass back to userspace through the struct?

The fb id.

> Do we
> just want to
> -#define DRM_IOCTL_MODE_ADDFB2          DRM_IOWR(0xB8, struct drm_mode_fb_cmd2)
> +#define DRM_IOCTL_MODE_ADDFB2          DRM_IOR(0xB8, struct drm_mode_fb_cmd2
> instead?
> -Chris
> 
> -- 
> Chris Wilson, Intel Open Source Technology Centre

-- 
Ville Syrj�l�
Intel OTC

Re: [PATCH 1/2] drm/i915: Don't clobber the addfb2 ioctl params

[Chris Wilson]

On Wed, Nov 11, 2015 at 07:24:40PM +0200, Ville Syrj�l� wrote:
> On Wed, Nov 11, 2015 at 05:20:10PM +0000, Chris Wilson wrote:
> > On Wed, Nov 11, 2015 at 07:11:28PM +0200, ville.syrjala@linux.intel.com wrote:
> > > From: Ville Syrj�l� <ville.syrjala@linux.intel.com>
> > > 
> > > We try to convert the old way of of specifying fb tiling (obj->tiling)
> > > into the new fb modifiers. We store the result in the passed in mode_cmd
> > > structure. But that structure comes directly from the addfb2 ioctl, and
> > > gets copied back out to userspace, which means we're clobbering the
> > > modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIFIERS
> > > flag wasn't even set by the user). Hence if the user reuses the struct
> > > for another addfb2, the ioctl will be rejected since it's now asking for
> > > some modifiers w/o the flag set.
> > 
> > What do we actually pass back to userspace through the struct?
> 
> The fb id.

D'oh. Time to step away from the computer...
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre

Re: [PATCH 1/2] drm/i915: Don't clobber the addfb2 ioctl params

[Daniel Vetter]

On Wed, Nov 11, 2015 at 07:11:28PM +0200, ville.syrjala@linux.intel.com wrote:
> From: Ville Syrj�l� <ville.syrjala@linux.intel.com>
> 
> We try to convert the old way of of specifying fb tiling (obj->tiling)
> into the new fb modifiers. We store the result in the passed in mode_cmd
> structure. But that structure comes directly from the addfb2 ioctl, and
> gets copied back out to userspace, which means we're clobbering the
> modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIFIERS
> flag wasn't even set by the user). Hence if the user reuses the struct
> for another addfb2, the ioctl will be rejected since it's now asking for
> some modifiers w/o the flag set.
> 
> Fix the problem by making a copy of the user provided structure. We can
> play any games we want with the copy.
> 
> Cc: stable@vger.kernel.org
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> Fixes: 2a80eada326f ("drm/i915: Add fb format modifier support")
> Testcase: igt/kms_addfb_basic/clobbered-modifier
> Signed-off-by: Ville Syrj�l� <ville.syrjala@linux.intel.com>

Out of curiosity: Where does this blow up? That should be added to the
commit message (so that people affected can match it up with this fix).
With that:

Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>


> ---
>  drivers/gpu/drm/i915/intel_display.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
> index b5f7493..c3aa6f5 100644
> --- a/drivers/gpu/drm/i915/intel_display.c
> +++ b/drivers/gpu/drm/i915/intel_display.c
> @@ -14578,17 +14578,18 @@ static int intel_framebuffer_init(struct drm_device *dev,
>  static struct drm_framebuffer *
>  intel_user_framebuffer_create(struct drm_device *dev,
>  			      struct drm_file *filp,
> -			      struct drm_mode_fb_cmd2 *mode_cmd)
> +			      struct drm_mode_fb_cmd2 *user_mode_cmd)
>  {
>  	struct drm_framebuffer *fb;
>  	struct drm_i915_gem_object *obj;
> +	struct drm_mode_fb_cmd2 mode_cmd = *user_mode_cmd;
>  
>  	obj = to_intel_bo(drm_gem_object_lookup(dev, filp,
> -						mode_cmd->handles[0]));
> +						mode_cmd.handles[0]));
>  	if (&obj->base == NULL)
>  		return ERR_PTR(-ENOENT);
>  
> -	fb = intel_framebuffer_create(dev, mode_cmd, obj);
> +	fb = intel_framebuffer_create(dev, &mode_cmd, obj);
>  	if (IS_ERR(fb))
>  		drm_gem_object_unreference_unlocked(&obj->base);
>  
> -- 
> 2.4.10
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch

Re: [PATCH 1/2] drm/i915: Don't clobber the addfb2 ioctl params

[Ville Syrjälä]

On Tue, Nov 17, 2015 at 10:47:06AM +0100, Daniel Vetter wrote:
> On Wed, Nov 11, 2015 at 07:11:28PM +0200, ville.syrjala@linux.intel.com wrote:
> > From: Ville Syrj�l� <ville.syrjala@linux.intel.com>
> > 
> > We try to convert the old way of of specifying fb tiling (obj->tiling)
> > into the new fb modifiers. We store the result in the passed in mode_cmd
> > structure. But that structure comes directly from the addfb2 ioctl, and
> > gets copied back out to userspace, which means we're clobbering the
> > modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIFIERS
> > flag wasn't even set by the user). Hence if the user reuses the struct
> > for another addfb2, the ioctl will be rejected since it's now asking for
> > some modifiers w/o the flag set.
> > 
> > Fix the problem by making a copy of the user provided structure. We can
> > play any games we want with the copy.
> > 
> > Cc: stable@vger.kernel.org
> > Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> > Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> > Fixes: 2a80eada326f ("drm/i915: Add fb format modifier support")
> > Testcase: igt/kms_addfb_basic/clobbered-modifier
> > Signed-off-by: Ville Syrj�l� <ville.syrjala@linux.intel.com>
> 
> Out of curiosity: Where does this blow up? That should be added to the
> commit message (so that people affected can match it up with this fix).

I don't know that it affects any actual users. The way I caught this was
running kms_addfb_basic. One of the subtests failed when I ran the full
test, but if I ran only the specific subtest it was fine. So the
modifiers got clobbered by the previous subtest. I already forgot which
subtest it was, but it's easy enough to track it down again.

> With that:
> 
> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> 
> 
> > ---
> >  drivers/gpu/drm/i915/intel_display.c | 7 ++++---
> >  1 file changed, 4 insertions(+), 3 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
> > index b5f7493..c3aa6f5 100644
> > --- a/drivers/gpu/drm/i915/intel_display.c
> > +++ b/drivers/gpu/drm/i915/intel_display.c
> > @@ -14578,17 +14578,18 @@ static int intel_framebuffer_init(struct drm_device *dev,
> >  static struct drm_framebuffer *
> >  intel_user_framebuffer_create(struct drm_device *dev,
> >  			      struct drm_file *filp,
> > -			      struct drm_mode_fb_cmd2 *mode_cmd)
> > +			      struct drm_mode_fb_cmd2 *user_mode_cmd)
> >  {
> >  	struct drm_framebuffer *fb;
> >  	struct drm_i915_gem_object *obj;
> > +	struct drm_mode_fb_cmd2 mode_cmd = *user_mode_cmd;
> >  
> >  	obj = to_intel_bo(drm_gem_object_lookup(dev, filp,
> > -						mode_cmd->handles[0]));
> > +						mode_cmd.handles[0]));
> >  	if (&obj->base == NULL)
> >  		return ERR_PTR(-ENOENT);
> >  
> > -	fb = intel_framebuffer_create(dev, mode_cmd, obj);
> > +	fb = intel_framebuffer_create(dev, &mode_cmd, obj);
> >  	if (IS_ERR(fb))
> >  		drm_gem_object_unreference_unlocked(&obj->base);
> >  
> > -- 
> > 2.4.10
> > 
> 
> -- 
> Daniel Vetter
> Software Engineer, Intel Corporation
> http://blog.ffwll.ch

-- 
Ville Syrj�l�
Intel OTC

Re: [Intel-gfx] [PATCH 1/2] drm/i915: Don't clobber the addfb2 ioctl params

[Ville Syrjälä]

On Tue, Nov 17, 2015 at 01:04:21PM +0200, Ville Syrj�l� wrote:
> On Tue, Nov 17, 2015 at 10:47:06AM +0100, Daniel Vetter wrote:
> > On Wed, Nov 11, 2015 at 07:11:28PM +0200, ville.syrjala@linux.intel.com wrote:
> > > From: Ville Syrj�l� <ville.syrjala@linux.intel.com>
> > > 
> > > We try to convert the old way of of specifying fb tiling (obj->tiling)
> > > into the new fb modifiers. We store the result in the passed in mode_cmd
> > > structure. But that structure comes directly from the addfb2 ioctl, and
> > > gets copied back out to userspace, which means we're clobbering the
> > > modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIFIERS
> > > flag wasn't even set by the user). Hence if the user reuses the struct
> > > for another addfb2, the ioctl will be rejected since it's now asking for
> > > some modifiers w/o the flag set.
> > > 
> > > Fix the problem by making a copy of the user provided structure. We can
> > > play any games we want with the copy.
> > > 
> > > Cc: stable@vger.kernel.org
> > > Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> > > Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> > > Fixes: 2a80eada326f ("drm/i915: Add fb format modifier support")
> > > Testcase: igt/kms_addfb_basic/clobbered-modifier
> > > Signed-off-by: Ville Syrj�l� <ville.syrjala@linux.intel.com>
> > 
> > Out of curiosity: Where does this blow up? That should be added to the
> > commit message (so that people affected can match it up with this fix).
> 
> I don't know that it affects any actual users. The way I caught this was
> running kms_addfb_basic. One of the subtests failed when I ran the full
> test, but if I ran only the specific subtest it was fine. So the
> modifiers got clobbered by the previous subtest. I already forgot which
> subtest it was, but it's easy enough to track it down again.

# ./tests/kms_addfb_basic 
IGT-Version: 1.12-git (x86_64) (Linux: 4.4.0-rc1-stereo+ x86_64)
...
Subtest basic-X-tiled: SUCCESS (0.001s)
Test assertion failure function pitch_tests, file kms_addfb_basic.c:167:
Failed assertion: drmIoctl(fd, DRM_IOCTL_MODE_ADDFB2, &f) == 0
Last errno: 22, Invalid argument
Stack trace:
  #0 [__igt_fail_assert+0x101]
  #1 [pitch_tests+0x619]
  #2 [__real_main426+0x2f]
  #3 [main+0x23]
  #4 [__libc_start_main+0xf0]
  #5 [_start+0x29]
  #6 [<unknown>+0x29]
Subtest framebuffer-vs-set-tiling failed.
**** DEBUG ****
Test assertion failure function pitch_tests, file kms_addfb_basic.c:167:
Failed assertion: drmIoctl(fd, DRM_IOCTL_MODE_ADDFB2, &f) == 0
Last errno: 22, Invalid argument
****  END  ****
Subtest framebuffer-vs-set-tiling: FAIL (0.003s)
...

# ./tests/kms_addfb_basic --r framebuffer-vs-set-tiling
IGT-Version: 1.12-git (x86_64) (Linux: 4.4.0-rc1-stereo+ x86_64)
Subtest framebuffer-vs-set-tiling: SUCCESS (0.000s)

> 
> > With that:
> > 
> > Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> > 
> > 
> > > ---
> > >  drivers/gpu/drm/i915/intel_display.c | 7 ++++---
> > >  1 file changed, 4 insertions(+), 3 deletions(-)
> > > 
> > > diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
> > > index b5f7493..c3aa6f5 100644
> > > --- a/drivers/gpu/drm/i915/intel_display.c
> > > +++ b/drivers/gpu/drm/i915/intel_display.c
> > > @@ -14578,17 +14578,18 @@ static int intel_framebuffer_init(struct drm_device *dev,
> > >  static struct drm_framebuffer *
> > >  intel_user_framebuffer_create(struct drm_device *dev,
> > >  			      struct drm_file *filp,
> > > -			      struct drm_mode_fb_cmd2 *mode_cmd)
> > > +			      struct drm_mode_fb_cmd2 *user_mode_cmd)
> > >  {
> > >  	struct drm_framebuffer *fb;
> > >  	struct drm_i915_gem_object *obj;
> > > +	struct drm_mode_fb_cmd2 mode_cmd = *user_mode_cmd;
> > >  
> > >  	obj = to_intel_bo(drm_gem_object_lookup(dev, filp,
> > > -						mode_cmd->handles[0]));
> > > +						mode_cmd.handles[0]));
> > >  	if (&obj->base == NULL)
> > >  		return ERR_PTR(-ENOENT);
> > >  
> > > -	fb = intel_framebuffer_create(dev, mode_cmd, obj);
> > > +	fb = intel_framebuffer_create(dev, &mode_cmd, obj);
> > >  	if (IS_ERR(fb))
> > >  		drm_gem_object_unreference_unlocked(&obj->base);
> > >  
> > > -- 
> > > 2.4.10
> > > 
> > 
> > -- 
> > Daniel Vetter
> > Software Engineer, Intel Corporation
> > http://blog.ffwll.ch
> 
> -- 
> Ville Syrj�l�
> Intel OTC
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx

-- 
Ville Syrj�l�
Intel OTC

Re: [Intel-gfx] [PATCH 1/2] drm/i915: Don't clobber the addfb2 ioctl params

[Jani Nikula]

On Tue, 17 Nov 2015, Ville Syrjälä <ville.syrjala@linux.intel.com> wrote:
> On Tue, Nov 17, 2015 at 01:04:21PM +0200, Ville Syrjälä wrote:
>> On Tue, Nov 17, 2015 at 10:47:06AM +0100, Daniel Vetter wrote:
>> > On Wed, Nov 11, 2015 at 07:11:28PM +0200, ville.syrjala@linux.intel.com wrote:
>> > > From: Ville Syrjälä <ville.syrjala@linux.intel.com>
>> > > 
>> > > We try to convert the old way of of specifying fb tiling (obj->tiling)
>> > > into the new fb modifiers. We store the result in the passed in mode_cmd
>> > > structure. But that structure comes directly from the addfb2 ioctl, and
>> > > gets copied back out to userspace, which means we're clobbering the
>> > > modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIFIERS
>> > > flag wasn't even set by the user). Hence if the user reuses the struct
>> > > for another addfb2, the ioctl will be rejected since it's now asking for
>> > > some modifiers w/o the flag set.
>> > > 
>> > > Fix the problem by making a copy of the user provided structure. We can
>> > > play any games we want with the copy.
>> > > 
>> > > Cc: stable@vger.kernel.org
>> > > Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
>> > > Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
>> > > Fixes: 2a80eada326f ("drm/i915: Add fb format modifier support")
>> > > Testcase: igt/kms_addfb_basic/clobbered-modifier
>> > > Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
>> > 
>> > Out of curiosity: Where does this blow up? That should be added to the
>> > commit message (so that people affected can match it up with this fix).
>> 
>> I don't know that it affects any actual users. The way I caught this was
>> running kms_addfb_basic. One of the subtests failed when I ran the full
>> test, but if I ran only the specific subtest it was fine. So the
>> modifiers got clobbered by the previous subtest. I already forgot which
>> subtest it was, but it's easy enough to track it down again.
>
> # ./tests/kms_addfb_basic 
> IGT-Version: 1.12-git (x86_64) (Linux: 4.4.0-rc1-stereo+ x86_64)
> ...
> Subtest basic-X-tiled: SUCCESS (0.001s)
> Test assertion failure function pitch_tests, file kms_addfb_basic.c:167:
> Failed assertion: drmIoctl(fd, DRM_IOCTL_MODE_ADDFB2, &f) == 0
> Last errno: 22, Invalid argument
> Stack trace:
>   #0 [__igt_fail_assert+0x101]
>   #1 [pitch_tests+0x619]
>   #2 [__real_main426+0x2f]
>   #3 [main+0x23]
>   #4 [__libc_start_main+0xf0]
>   #5 [_start+0x29]
>   #6 [<unknown>+0x29]
> Subtest framebuffer-vs-set-tiling failed.
> **** DEBUG ****
> Test assertion failure function pitch_tests, file kms_addfb_basic.c:167:
> Failed assertion: drmIoctl(fd, DRM_IOCTL_MODE_ADDFB2, &f) == 0
> Last errno: 22, Invalid argument
> ****  END  ****
> Subtest framebuffer-vs-set-tiling: FAIL (0.003s)
> ...
>
> # ./tests/kms_addfb_basic --r framebuffer-vs-set-tiling
> IGT-Version: 1.12-git (x86_64) (Linux: 4.4.0-rc1-stereo+ x86_64)
> Subtest framebuffer-vs-set-tiling: SUCCESS (0.000s)
>
>> 
>> > With that:
>> > 
>> > Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Pushed to drm-intel-fixes, thanks for the patch and review.

I had to do a trivial rebase, and resolve conflicts for nightly. Ville,
please check the commit in -fixes and yell if it's not right.


BR,
Jani.


-- 
Jani Nikula, Intel Open Source Technology Center