From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ilija Hadzic Subject: [PATCH 16/19] drm: more elaborate check for resource count Date: Thu, 12 Apr 2012 14:19:41 -0400 Message-ID: <1334254784-3200-17-git-send-email-ihadzic@research.bell-labs.com> References: <1334254784-3200-1-git-send-email-ihadzic@research.bell-labs.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from ihemail4.lucent.com (ihemail4.lucent.com [135.245.0.39]) by gabe.freedesktop.org (Postfix) with ESMTP id 5F11A9E827 for ; Thu, 12 Apr 2012 11:21:50 -0700 (PDT) Received: from usnavsmail3.ndc.alcatel-lucent.com (usnavsmail3.ndc.alcatel-lucent.com [135.3.39.11]) by ihemail4.lucent.com (8.13.8/IER-o) with ESMTP id q3CILlg8028688 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 12 Apr 2012 13:21:48 -0500 (CDT) Received: from umail.lucent.com (umail-ce2.ndc.lucent.com [135.3.40.63]) by usnavsmail3.ndc.alcatel-lucent.com (8.14.3/8.14.3/GMO) with ESMTP id q3CILlgP022475 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 12 Apr 2012 13:21:47 -0500 In-Reply-To: <1334254784-3200-1-git-send-email-ihadzic@research.bell-labs.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org Errors-To: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org To: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org User space can send us all kinds of nonsense for num_crtc, num_encoder, num_connector, or num_plane. So far, we have been checking only for presence of at least one CRTC/encoder/connector (barring the trivial case of a render node with no display resources, i.e., GPGPU node). This patch makes the ioctl fail if user space requests more resources than the physical GPU has. This is primarily to protect the kmalloc in drm_mode_group_init from hogging a big chunk of memory if some bozo sends us a request for some huge number of CRTCs, encoders, or connectors. v2: - fail when user space asks for more planes than available from physical device, but still allow zero planes (which is a legitimate case) Signed-off-by: Ilija Hadzic --- drivers/gpu/drm/drm_stub.c | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c index 20c72b0..7aa54fb 100644 --- a/drivers/gpu/drm/drm_stub.c +++ b/drivers/gpu/drm/drm_stub.c @@ -574,9 +574,12 @@ int drm_render_node_create_ioctl(struct drm_device *dev, void *data, return ret; } - /* if we have display resources, then we need at least - * one CRTC, one encoder and one connector */ - if (args->num_crtc == 0 || + /* sanity check for requested num_crtc/_encoder/_connector/_plane */ + if (args->num_crtc > dev->mode_config.num_crtc || + args->num_encoder > dev->mode_config.num_encoder || + args->num_encoder > dev->mode_config.num_connector || + args->num_plane > dev->mode_config.num_plane || + args->num_crtc == 0 || args->num_encoder == 0 || args->num_connector == 0) return -EINVAL; -- 1.7.8.5