diff mbox

drm/exynos: forbid creating framebuffers from too small GEM buffers

Message ID 1499854165-10902-1-git-send-email-m.szyprowski@samsung.com
State Accepted
Commit 1899bd57570a3e610db574b57d1e7e66378aa908
Headers show

Commit Message

Marek Szyprowski July 12, 2017, 10:09 a.m. UTC 
Add a check if the framebuffer described by the provided drm_mode_fb_cmd2
structure fits into provided GEM buffers. Without this check it is
possible to create a framebuffer object from a small buffer and set it to
the hardware, what results in displaying system memory outside the
allocated GEM buffer.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
CC: stable@vger.kernel.org # v4.7+
---
This issue was there from the beggining, but the provided patch applies only
to v4.7+ kernels due to other changes in the fixed code.
---
 drivers/gpu/drm/exynos/exynos_drm_fb.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

Comments

대인기/Tizen Platform Lab(SR)/삼성전자 Aug. 8, 2017, 10:57 p.m. UTC | #1 
2017년 08월 08일 22:33에 Marek Szyprowski 이(가) 쓴 글:
> Hi all,
> 
> On 2017-07-12 12:09, Marek Szyprowski wrote:
>> Add a check if the framebuffer described by the provided drm_mode_fb_cmd2
>> structure fits into provided GEM buffers. Without this check it is
>> possible to create a framebuffer object from a small buffer and set it to
>> the hardware, what results in displaying system memory outside the
>> allocated GEM buffer.
>>
>> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
>> CC: stable@vger.kernel.org # v4.7+
> 
> Gentle ping.

Applied.

Thanks,
Inki Dae

> 
>> ---
>> This issue was there from the beggining, but the provided patch applies only
>> to v4.7+ kernels due to other changes in the fixed code.
>> ---
>>   drivers/gpu/drm/exynos/exynos_drm_fb.c | 14 +++++++++++++-
>>   1 file changed, 13 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
>> index d48fd7c918f8..73217c281c9a 100644
>> --- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
>> +++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
>> @@ -145,13 +145,19 @@ struct drm_framebuffer *
>>   exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
>>                 const struct drm_mode_fb_cmd2 *mode_cmd)
>>   {
>> +    const struct drm_format_info *info = drm_get_format_info(dev, mode_cmd);
>>       struct exynos_drm_gem *exynos_gem[MAX_FB_BUFFER];
>>       struct drm_gem_object *obj;
>>       struct drm_framebuffer *fb;
>>       int i;
>>       int ret;
>>   -    for (i = 0; i < drm_format_num_planes(mode_cmd->pixel_format); i++) {
>> +    for (i = 0; i < info->num_planes; i++) {
>> +        unsigned int height = (i == 0) ? mode_cmd->height :
>> +                     DIV_ROUND_UP(mode_cmd->height, info->vsub);
>> +        unsigned long size = height * mode_cmd->pitches[i] +
>> +                     mode_cmd->offsets[i];
>> +
>>           obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[i]);
>>           if (!obj) {
>>               DRM_ERROR("failed to lookup gem object\n");
>> @@ -160,6 +166,12 @@ struct drm_framebuffer *
>>           }
>>             exynos_gem[i] = to_exynos_gem(obj);
>> +
>> +        if (size > exynos_gem[i]->size) {
>> +            i++;
>> +            ret = -EINVAL;
>> +            goto err;
>> +        }
>>       }
>>         fb = exynos_drm_framebuffer_init(dev, mode_cmd, exynos_gem, i);
> 
> Best regards
diff mbox

Patch

diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index d48fd7c918f8..73217c281c9a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -145,13 +145,19 @@  struct drm_framebuffer *
 exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
 		      const struct drm_mode_fb_cmd2 *mode_cmd)
 {
+	const struct drm_format_info *info = drm_get_format_info(dev, mode_cmd);
 	struct exynos_drm_gem *exynos_gem[MAX_FB_BUFFER];
 	struct drm_gem_object *obj;
 	struct drm_framebuffer *fb;
 	int i;
 	int ret;
 
-	for (i = 0; i < drm_format_num_planes(mode_cmd->pixel_format); i++) {
+	for (i = 0; i < info->num_planes; i++) {
+		unsigned int height = (i == 0) ? mode_cmd->height :
+				     DIV_ROUND_UP(mode_cmd->height, info->vsub);
+		unsigned long size = height * mode_cmd->pitches[i] +
+				     mode_cmd->offsets[i];
+
 		obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[i]);
 		if (!obj) {
 			DRM_ERROR("failed to lookup gem object\n");
@@ -160,6 +166,12 @@  struct drm_framebuffer *
 		}
 
 		exynos_gem[i] = to_exynos_gem(obj);
+
+		if (size > exynos_gem[i]->size) {
+			i++;
+			ret = -EINVAL;
+			goto err;
+		}
 	}
 
 	fb = exynos_drm_framebuffer_init(dev, mode_cmd, exynos_gem, i);