Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 93ddb0d3 authored by Rob Clark's avatar Rob Clark
Browse files

drm/msm: validate flags, etc 

After reading a nice article on LWN[1], I went back and double checked
my handling of invalid-input checking.  Turns out there were a couple
places I had missed.

Since the driver is fairly young, and the devices it supports are really
only just barely usable for basic stuff (serial console) with an
upstream kernel, I think we should fix this now and revert specific
parts of this patch later in the unlikely event that a regression is
reported.

[1] https://lwn.net/Articles/588444/



Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
parent 060530f1

drivers/gpu/drm/msm/msm_drv.c

+19 −1
Original line number Diff line number Diff line
@@ -664,6 +664,12 @@ static int msm_ioctl_gem_new(struct drm_device *dev, void *data, 
		struct drm_file *file)

{

	struct drm_msm_gem_new *args = data;



	if (args->flags & ~MSM_BO_FLAGS) {

		DRM_ERROR("invalid flags: %08x\n", args->flags);

		return -EINVAL;

	}



	return msm_gem_new_handle(dev, file, args->size,

			args->flags, &args->handle);

}
@@ -677,6 +683,11 @@ static int msm_ioctl_gem_cpu_prep(struct drm_device *dev, void *data, 
	struct drm_gem_object *obj;

	int ret;



	if (args->op & ~MSM_PREP_FLAGS) {

		DRM_ERROR("invalid op: %08x\n", args->op);

		return -EINVAL;

	}



	obj = drm_gem_object_lookup(dev, file, args->handle);

	if (!obj)

		return -ENOENT;
@@ -731,7 +742,14 @@ static int msm_ioctl_wait_fence(struct drm_device *dev, void *data, 
		struct drm_file *file)

{

	struct drm_msm_wait_fence *args = data;

	return msm_wait_fence_interruptable(dev, args->fence, &TS(args->timeout));



	if (args->pad) {

		DRM_ERROR("invalid pad: %08x\n", args->pad);

		return -EINVAL;

	}



	return msm_wait_fence_interruptable(dev, args->fence,

			&TS(args->timeout));

}



static const struct drm_ioctl_desc msm_ioctls[] = {

drivers/gpu/drm/msm/msm_gem_submit.c

+13 −2
Original line number Diff line number Diff line
@@ -23,7 +23,6 @@ 
 * Cmdstream submission:

 */



#define BO_INVALID_FLAGS ~(MSM_SUBMIT_BO_READ | MSM_SUBMIT_BO_WRITE)

/* make sure these don't conflict w/ MSM_SUBMIT_BO_x */

#define BO_VALID    0x8000

#define BO_LOCKED   0x4000
@@ -77,7 +76,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, 
			goto out_unlock;

		}



		if (submit_bo.flags & BO_INVALID_FLAGS) {

		if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {

			DRM_ERROR("invalid flags: %x\n", submit_bo.flags);

			ret = -EINVAL;

			goto out_unlock;
@@ -369,6 +368,18 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, 
			goto out;

		}



		/* validate input from userspace: */

		switch (submit_cmd.type) {

		case MSM_SUBMIT_CMD_BUF:

		case MSM_SUBMIT_CMD_IB_TARGET_BUF:

		case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:

			break;

		default:

			DRM_ERROR("invalid type: %08x\n", submit_cmd.type);

			ret = -EINVAL;

			goto out;

		}



		ret = submit_bo(submit, submit_cmd.submit_idx,

				&msm_obj, &iova, NULL);

		if (ret)

include/uapi/drm/msm_drm.h

+11 −0
Original line number Diff line number Diff line
@@ -70,6 +70,12 @@ struct drm_msm_param { 
#define MSM_BO_WC            0x00020000

#define MSM_BO_UNCACHED      0x00040000



#define MSM_BO_FLAGS         (MSM_BO_SCANOUT | \

                              MSM_BO_GPU_READONLY | \

                              MSM_BO_CACHED | \

                              MSM_BO_WC | \

                              MSM_BO_UNCACHED)



struct drm_msm_gem_new {

	uint64_t size;           /* in */

	uint32_t flags;          /* in, mask of MSM_BO_x */
@@ -86,6 +92,8 @@ struct drm_msm_gem_info { 
#define MSM_PREP_WRITE       0x02

#define MSM_PREP_NOSYNC      0x04



#define MSM_PREP_FLAGS       (MSM_PREP_READ | MSM_PREP_WRITE | MSM_PREP_NOSYNC)



struct drm_msm_gem_cpu_prep {

	uint32_t handle;         /* in */

	uint32_t op;             /* in, mask of MSM_PREP_x */
@@ -153,6 +161,9 @@ struct drm_msm_gem_submit_cmd { 
 */

#define MSM_SUBMIT_BO_READ             0x0001

#define MSM_SUBMIT_BO_WRITE            0x0002



#define MSM_SUBMIT_BO_FLAGS            (MSM_SUBMIT_BO_READ | MSM_SUBMIT_BO_WRITE)



struct drm_msm_gem_submit_bo {

	uint32_t flags;          /* in, mask of MSM_SUBMIT_BO_x */

	uint32_t handle;         /* in, GEM handle */