From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ilija Hadzic Subject: [PATCH 17/19] drm: validate id list when creating a render node Date: Thu, 12 Apr 2012 14:19:42 -0400 Message-ID: <1334254784-3200-18-git-send-email-ihadzic@research.bell-labs.com> References: <1334254784-3200-1-git-send-email-ihadzic@research.bell-labs.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from ihemail2.lucent.com (ihemail2.lucent.com [135.245.0.35]) by gabe.freedesktop.org (Postfix) with ESMTP id 98CC7A0AD5 for ; Thu, 12 Apr 2012 11:21:52 -0700 (PDT) Received: from usnavsmail2.ndc.alcatel-lucent.com (usnavsmail2.ndc.alcatel-lucent.com [135.3.39.10]) by ihemail2.lucent.com (8.13.8/IER-o) with ESMTP id q3CILq5f007192 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 12 Apr 2012 13:21:52 -0500 (CDT) Received: from umail.lucent.com (umail-ce2.ndc.lucent.com [135.3.40.63]) by usnavsmail2.ndc.alcatel-lucent.com (8.14.3/8.14.3/GMO) with ESMTP id q3CILplF011075 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 12 Apr 2012 13:21:51 -0500 In-Reply-To: <1334254784-3200-1-git-send-email-ihadzic@research.bell-labs.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org Errors-To: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org To: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org Render node ioctl requires a list of DRM mode objects in specific order: first all CRTCs, then all encoders, followed by all connectors. Check that the IDs passed from userland are in conformance with this requirement and that they are consistent with specified num_crtc, num_encoder and num_connector values. Return -EINVAL to if the check fails. Otherwise, accept the list and create the requested render node. v2: - also check planes Signed-off-by: Ilija Hadzic --- drivers/gpu/drm/drm_stub.c | 68 ++++++++++++++++++++++++++++++++++++++----- 1 files changed, 60 insertions(+), 8 deletions(-) diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c index 7aa54fb..340a7e4 100644 --- a/drivers/gpu/drm/drm_stub.c +++ b/drivers/gpu/drm/drm_stub.c @@ -399,6 +399,54 @@ err_idr: return ret; } +static int drm_get_id_from_user(struct drm_device *dev, + uint32_t *id_dst, + uint32_t __user *id_src, + uint32_t expected_type) +{ + struct drm_mode_object *drmmode_obj; + uint32_t id; + + if (get_user(id, id_src)) + return -EFAULT; + drmmode_obj = drm_mode_object_find(dev, id, expected_type); + if (!drmmode_obj) + return -EINVAL; + *id_dst = id; + return 0; +} + +#define DRM_RN_NUM_EXP_TYPES 4 +static const uint32_t expected_type_list[DRM_RN_NUM_EXP_TYPES] = { + DRM_MODE_OBJECT_CRTC, + DRM_MODE_OBJECT_ENCODER, + DRM_MODE_OBJECT_CONNECTOR, + DRM_MODE_OBJECT_PLANE +}; + +static int drm_get_render_node_resources(struct drm_device *dev, + uint32_t *id_list, + uint32_t __user *ids_ptr, + int *resource_count) + +{ + int s, e, i, j; + int ret; + + for (e = 0, j = 0; j < DRM_RN_NUM_EXP_TYPES; j++) { + s = e; + e += resource_count[j]; + for (i = s; i < e; i++) { + ret = drm_get_id_from_user(dev, &id_list[i], + &ids_ptr[i], + expected_type_list[j]); + if (ret) + return ret; + } + } + return 0; +} + int drm_create_render_node(struct drm_device *dev, struct drm_minor **minor_p) { int ret; @@ -558,8 +606,10 @@ int drm_render_node_create_ioctl(struct drm_device *dev, void *data, struct drm_render_node_create *args = data; int ret; struct drm_minor *new_minor; - int total_ids, i; + int total_ids; + int resource_count[DRM_RN_NUM_EXP_TYPES]; uint32_t __user *ids_ptr; + uint32_t *id_list; /* allow access through control node only */ if (file_priv->minor != dev->control) @@ -592,14 +642,16 @@ int drm_render_node_create_ioctl(struct drm_device *dev, void *data, ret = drm_mode_group_init(&new_minor->mode_group, total_ids); if (ret) goto out_del; - + resource_count[0] = args->num_crtc; + resource_count[1] = args->num_encoder; + resource_count[2] = args->num_connector; + resource_count[3] = args->num_plane; ids_ptr = (uint32_t __user *)(unsigned long)args->id_list_ptr; - for (i = 0; i < total_ids; i++) { - if (get_user(new_minor->mode_group.id_list[i], &ids_ptr[i])) { - ret = -EFAULT; - goto out_del; - } - } + id_list = new_minor->mode_group.id_list; + ret = drm_get_render_node_resources(dev, id_list, ids_ptr, + resource_count); + if (ret) + goto out_del; new_minor->mode_group.num_crtcs = args->num_crtc; new_minor->mode_group.num_encoders = args->num_encoder; new_minor->mode_group.num_connectors = args->num_connector; -- 1.7.8.5