[PATCH 1/3] drm/exynos: Remove Kconfig deps for FIMD and DECON7

[PATCH 1/3] drm/exynos: Remove Kconfig deps for FIMD and DECON7

[Tobias Jakobi]

While the Kconfig entries of FIMD and DECON7 both select
FB_MODE_HELPERS, the code doesn't use any of the functionality.

Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
---
 drivers/gpu/drm/exynos/Kconfig | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index d706ca4..1d18534 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -19,7 +19,6 @@ comment "CRTCs"
 config DRM_EXYNOS_FIMD
 	bool "FIMD"
 	depends on !FB_S3C
-	select FB_MODE_HELPERS
 	select MFD_SYSCON
 	help
 	  Choose this option if you want to use Exynos FIMD for DRM.
@@ -32,7 +31,6 @@ config DRM_EXYNOS5433_DECON
 config DRM_EXYNOS7_DECON
 	bool "DECON on Exynos7"
 	depends on !FB_S3C
-	select FB_MODE_HELPERS
 	help
 	  Choose this option if you want to use Exynos DECON for DRM.
 
-- 
2.7.3

[PATCH 2/3] drm/exynos: g2d: change platform driver name to 'exynos-drm-g2d'

[Tobias Jakobi]

The current name is 's5p-g2d', which is identical with the driver
name of the old V4L2 driver in media/platform.
This is probably due to the DRM driver being based on the V4L2
driver when it was initially created. Still the clashing of driver
names is confusing, so rename it to something in line with the
other DRM subdrivers.

Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
---
 drivers/gpu/drm/exynos/exynos_drm_g2d.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index fbd13fa..6962f6b1 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -1668,7 +1668,7 @@ struct platform_driver g2d_driver = {
 	.probe		= g2d_probe,
 	.remove		= g2d_remove,
 	.driver		= {
-		.name	= "s5p-g2d",
+		.name	= "exynos-drm-g2d",
 		.owner	= THIS_MODULE,
 		.pm	= &g2d_pm_ops,
 		.of_match_table = exynos_g2d_match,
-- 
2.7.3

[PATCH 3/3] drm/exynos: g2d: prevent integer overflow in set_cmdlist() ioctl

[Tobias Jakobi]

From: Joonyoung Shim <jy0922.shim@samsung.com>

The size computations done in the ioctl function use an integer.
If userspace submits a request with req->cmd_nr or req->cmd_buf_nr
set to INT_MAX, the integer computations overflow later, leading
to potential (kernel) memory corruption.

Prevent this issue by enforcing a limit on the number of submitted
commands, so that we have enough headroom later for the size
computations.

Note that this change has no impact on the currently available
users in userspace, like e.g. libdrm/exynos.

While at it, also make a comment about the size computation more
detailed.

Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com>
Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
---
 drivers/gpu/drm/exynos/exynos_drm_g2d.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 6962f6b1..f8737d43 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -1193,6 +1193,16 @@ int exynos_g2d_set_cmdlist_ioctl(struct drm_device *drm_dev, void *data,
 	if (!node)
 		return -ENOMEM;
 
+	/*
+	 * To avoid an integer overflow for the later size computations, we
+	 * enforce a maximum number of submitted commands here. This limit is
+	 * sufficient for all conceivable usage cases of the G2D.
+	 */
+	if (req->cmd_nr > G2D_CMDLIST_DATA_NUM || req->cmd_buf_nr > G2D_CMDLIST_DATA_NUM) {
+		dev_err(dev, "number of submitted G2D commands exceeds limit\n");
+		return -EINVAL;
+	}
+
 	node->event = NULL;
 
 	if (req->event_type != G2D_EVENT_NOT) {
@@ -1250,7 +1260,11 @@ int exynos_g2d_set_cmdlist_ioctl(struct drm_device *drm_dev, void *data,
 		cmdlist->data[cmdlist->last++] = G2D_INTEN_ACF;
 	}
 
-	/* Check size of cmdlist: last 2 is about G2D_BITBLT_START */
+	/*
+	 * Check the size of cmdlist. The 2 that is added last comes from
+	 * the implicit G2D_BITBLT_START that is appended once we have
+	 * checked all the submitted commands.
+	 */
 	size = cmdlist->last + req->cmd_nr * 2 + req->cmd_buf_nr * 2 + 2;
 	if (size > G2D_CMDLIST_DATA_NUM) {
 		dev_err(dev, "cmdlist size is too big\n");
-- 
2.7.3

Re: [PATCH 1/3] drm/exynos: Remove Kconfig deps for FIMD and DECON7

[Daniel Vetter]

On Fri, Jan 20, 2017 at 05:02:50PM +0100, Tobias Jakobi wrote:
> While the Kconfig entries of FIMD and DECON7 both select
> FB_MODE_HELPERS, the code doesn't use any of the functionality.
> 
> Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>

Applied (just this patch) to drm-misc, since that Kconfig stuff also went
in through drm-misc. I'll leave the other 2 for exynos drivers for proper
review.

Thanks, Daniel
> ---
>  drivers/gpu/drm/exynos/Kconfig | 2 --
>  1 file changed, 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
> index d706ca4..1d18534 100644
> --- a/drivers/gpu/drm/exynos/Kconfig
> +++ b/drivers/gpu/drm/exynos/Kconfig
> @@ -19,7 +19,6 @@ comment "CRTCs"
>  config DRM_EXYNOS_FIMD
>  	bool "FIMD"
>  	depends on !FB_S3C
> -	select FB_MODE_HELPERS
>  	select MFD_SYSCON
>  	help
>  	  Choose this option if you want to use Exynos FIMD for DRM.
> @@ -32,7 +31,6 @@ config DRM_EXYNOS5433_DECON
>  config DRM_EXYNOS7_DECON
>  	bool "DECON on Exynos7"
>  	depends on !FB_S3C
> -	select FB_MODE_HELPERS
>  	help
>  	  Choose this option if you want to use Exynos DECON for DRM.
>  
> -- 
> 2.7.3
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel