drm: Don't call drm_for_each_crtc with a non-KMS driver (e94bd173) · Commits · e / devices / android_kernel_oneplus_sm8150

Fixes oops if userspace calls DRM_IOCTL_GET_CAP for DRM_CAP_PAGE_FLIP_TARGET on a non-KMS device node. (Normal userspace doesn't do that, discovered by syzkaller) Reported-by:

Dmitry Vyukov <dvyukov@google.com> Fixes: ("drm: Add DRM_MODE_PAGE_FLIP_TARGET_ABSOLUTE/RELATIVE flags v2") Cc: stable@vger.kernel.org Signed-off-by:

Michel Dänzer <michel.daenzer@amd.com> Signed-off-by:

Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20161130083002.1520-1-michel@daenzer.net

drivers/gpu/drm/drm_ioctl.c

+6 −4

Original line number	Original line	Diff line number	Diff line
	@@ -254,11 +254,13 @@ static int drm_getcap(struct drm_device dev, void data, struct drm_file *file_
	req->value = dev->mode_config.async_page_flip;		req->value = dev->mode_config.async_page_flip;
	break;		break;
	case DRM_CAP_PAGE_FLIP_TARGET:		case DRM_CAP_PAGE_FLIP_TARGET:
			if (drm_core_check_feature(dev, DRIVER_MODESET)) {
	req->value = 1;		req->value = 1;
	drm_for_each_crtc(crtc, dev) {		drm_for_each_crtc(crtc, dev) {
	if (!crtc->funcs->page_flip_target)		if (!crtc->funcs->page_flip_target)
	req->value = 0;		req->value = 0;
	}		}
			}
	break;		break;
	case DRM_CAP_CURSOR_WIDTH:		case DRM_CAP_CURSOR_WIDTH:
	if (dev->mode_config.cursor_width)		if (dev->mode_config.cursor_width)