From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ilija Hadzic Subject: [PATCH 14/16] drm: validate id list when creating a render node Date: Thu, 29 Mar 2012 12:41:36 -0400 Message-ID: <1333039298-2520-15-git-send-email-ihadzic@research.bell-labs.com> References: <1333039298-2520-1-git-send-email-ihadzic@research.bell-labs.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from ihemail2.lucent.com (ihemail2.lucent.com [135.245.0.35]) by gabe.freedesktop.org (Postfix) with ESMTP id 286069F5BC for ; Thu, 29 Mar 2012 09:42:19 -0700 (PDT) Received: from usnavsmail4.ndc.alcatel-lucent.com (usnavsmail4.ndc.alcatel-lucent.com [135.3.39.12]) by ihemail2.lucent.com (8.13.8/IER-o) with ESMTP id q2TGg85t000729 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 29 Mar 2012 11:42:09 -0500 (CDT) Received: from umail.lucent.com (umail-ce2.ndc.lucent.com [135.3.40.63]) by usnavsmail4.ndc.alcatel-lucent.com (8.14.3/8.14.3/GMO) with ESMTP id q2TGg7WD006356 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 29 Mar 2012 11:42:08 -0500 In-Reply-To: <1333039298-2520-1-git-send-email-ihadzic@research.bell-labs.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org Errors-To: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org To: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org Render node ioctl requires a list of DRM mode objects in specific order: first all CRTCs, then all encoders, followed by all connectors. Check that the IDs passed from userland are in conformance with this requirement and that they are consistent with specified num_crtc, num_encoder and num_connector values. Return -EINVAL to if the check fails. Otherwise, accept the list and create the requested render node. Signed-off-by: Ilija Hadzic --- drivers/gpu/drm/drm_stub.c | 66 ++++++++++++++++++++++++++++++++++++++----- 1 files changed, 58 insertions(+), 8 deletions(-) diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c index 196892c..5b6459f 100644 --- a/drivers/gpu/drm/drm_stub.c +++ b/drivers/gpu/drm/drm_stub.c @@ -399,6 +399,53 @@ err_idr: return ret; } +static int drm_get_id_from_user(struct drm_device *dev, + uint32_t *id_dst, + uint32_t __user *id_src, + uint32_t expected_type) +{ + struct drm_mode_object *drmmode_obj; + uint32_t id; + + if (get_user(id, id_src)) + return -EFAULT; + drmmode_obj = drm_mode_object_find(dev, id, expected_type); + if (!drmmode_obj) + return -EINVAL; + *id_dst = id; + return 0; +} + +#define DRM_RN_NUM_EXP_TYPES 3 +static const uint32_t expected_type_list[DRM_RN_NUM_EXP_TYPES] = { + DRM_MODE_OBJECT_CRTC, + DRM_MODE_OBJECT_ENCODER, + DRM_MODE_OBJECT_CONNECTOR +}; + +static int drm_get_render_node_resources(struct drm_device *dev, + uint32_t *id_list, + uint32_t __user *ids_ptr, + int *resource_count) + +{ + int s, e, i, j; + int ret; + + for (e = 0, j = 0; j < DRM_RN_NUM_EXP_TYPES; j++) { + s = e; + e += resource_count[j]; + for (i = s; i < e; i++) { + ret = drm_get_id_from_user(dev, &id_list[i], + &ids_ptr[i], + expected_type_list[j]); + if (ret) + return ret; + } + } + return 0; +} + int drm_create_render_node(struct drm_device *dev, struct drm_minor **minor_p) { int ret; @@ -558,8 +605,10 @@ int drm_render_node_create_ioctl(struct drm_device *dev, void *data, struct drm_render_node_create *args = data; int ret; struct drm_minor *new_minor; - int total_ids, i; + int total_ids; + int resource_count[DRM_RN_NUM_EXP_TYPES]; uint32_t __user *ids_ptr; + uint32_t *id_list; /* allow access through control node only */ if (file_priv->minor != dev->control) @@ -591,14 +640,15 @@ int drm_render_node_create_ioctl(struct drm_device *dev, void *data, ret = drm_mode_group_init(&new_minor->mode_group, total_ids); if (ret) goto out_del; - + resource_count[0] = args->num_crtc; + resource_count[1] = args->num_encoder; + resource_count[2] = args->num_connector; ids_ptr = (uint32_t __user *)(unsigned long)args->id_list_ptr; - for (i = 0; i < total_ids; i++) { - if (get_user(new_minor->mode_group.id_list[i], &ids_ptr[i])) { - ret = -EFAULT; - goto out_del; - } - } + id_list = new_minor->mode_group.id_list; + ret = drm_get_render_node_resources(dev, id_list, ids_ptr, + resource_count); + if (ret) + goto out_del; new_minor->mode_group.num_crtcs = args->num_crtc; new_minor->mode_group.num_encoders = args->num_encoder; new_minor->mode_group.num_connectors = args->num_connector; -- 1.7.8.5