All of lore.kernel.org
 help / color / mirror / Atom feed
From: Drew Davenport <ddavenport@chromium.org>
To: intel-gfx@lists.freedesktop.org
Cc: "Drew Davenport" <ddavenport@chromium.org>,
	"Daniel Vetter" <daniel@ffwll.ch>,
	"David Airlie" <airlied@gmail.com>,
	"Imre Deak" <imre.deak@intel.com>,
	"Jani Nikula" <jani.nikula@linux.intel.com>,
	"Joonas Lahtinen" <joonas.lahtinen@linux.intel.com>,
	"José Roberto de Souza" <jose.souza@intel.com>,
	"Juha-Pekka Heikkilä" <juha-pekka.heikkila@intel.com>,
	"Matt Roper" <matthew.d.roper@intel.com>,
	"Rodrigo Vivi" <rodrigo.vivi@intel.com>,
	"Thomas Zimmermann" <tzimmermann@suse.de>,
	"Tvrtko Ursulin" <tvrtko.ursulin@linux.intel.com>,
	"Ville Syrjälä" <ville.syrjala@linux.intel.com>,
	dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: [PATCH] drm/i915/display: Check source height is > 0
Date: Mon, 26 Dec 2022 22:53:24 -0700	[thread overview]
Message-ID: <20221226225246.1.I15dff7bb5a0e485c862eae61a69096caf12ef29f@changeid> (raw)

The error message suggests that the height of the src rect must be at
least 1. Reject source with height of 0.

Signed-off-by: Drew Davenport <ddavenport@chromium.org>

---
I was investigating some divide-by-zero crash reports on ChromeOS which
pointed to the intel_adjusted_rate function. Further prodding showed
that I could reproduce this in a simple test program if I made src_h
some value less than 1 but greater than 0.

This seemed to be a sensible place to check that the source height is at
least 1. I tried to repro this issue on an amd device I had on hand, and
the configuration was rejected.

Would it make sense to add a check that source dimensions are at least 1
somewhere in core, like in drm_atomic_plane_check? Or is that a valid
use case on some devices, and thus any such check should be done on a
per-driver basis?

Thanks.

 drivers/gpu/drm/i915/display/skl_universal_plane.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/display/skl_universal_plane.c b/drivers/gpu/drm/i915/display/skl_universal_plane.c
index 4b79c2d2d6177..9b172a1e90deb 100644
--- a/drivers/gpu/drm/i915/display/skl_universal_plane.c
+++ b/drivers/gpu/drm/i915/display/skl_universal_plane.c
@@ -1627,7 +1627,7 @@ static int skl_check_main_surface(struct intel_plane_state *plane_state)
 	u32 offset;
 	int ret;
 
-	if (w > max_width || w < min_width || h > max_height) {
+	if (w > max_width || w < min_width || h > max_height || h < 1) {
 		drm_dbg_kms(&dev_priv->drm,
 			    "requested Y/RGB source size %dx%d outside limits (min: %dx1 max: %dx%d)\n",
 			    w, h, min_width, max_width, max_height);
-- 
2.39.0.314.g84b9a713c41-goog


WARNING: multiple messages have this Message-ID (diff)
From: Drew Davenport <ddavenport@chromium.org>
To: intel-gfx@lists.freedesktop.org
Cc: dri-devel@lists.freedesktop.org,
	"Tvrtko Ursulin" <tvrtko.ursulin@linux.intel.com>,
	"Thomas Zimmermann" <tzimmermann@suse.de>,
	linux-kernel@vger.kernel.org,
	"José Roberto de Souza" <jose.souza@intel.com>,
	"Rodrigo Vivi" <rodrigo.vivi@intel.com>,
	"Drew Davenport" <ddavenport@chromium.org>,
	"Juha-Pekka Heikkilä" <juha-pekka.heikkila@intel.com>
Subject: [PATCH] drm/i915/display: Check source height is > 0
Date: Mon, 26 Dec 2022 22:53:24 -0700	[thread overview]
Message-ID: <20221226225246.1.I15dff7bb5a0e485c862eae61a69096caf12ef29f@changeid> (raw)

The error message suggests that the height of the src rect must be at
least 1. Reject source with height of 0.

Signed-off-by: Drew Davenport <ddavenport@chromium.org>

---
I was investigating some divide-by-zero crash reports on ChromeOS which
pointed to the intel_adjusted_rate function. Further prodding showed
that I could reproduce this in a simple test program if I made src_h
some value less than 1 but greater than 0.

This seemed to be a sensible place to check that the source height is at
least 1. I tried to repro this issue on an amd device I had on hand, and
the configuration was rejected.

Would it make sense to add a check that source dimensions are at least 1
somewhere in core, like in drm_atomic_plane_check? Or is that a valid
use case on some devices, and thus any such check should be done on a
per-driver basis?

Thanks.

 drivers/gpu/drm/i915/display/skl_universal_plane.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/display/skl_universal_plane.c b/drivers/gpu/drm/i915/display/skl_universal_plane.c
index 4b79c2d2d6177..9b172a1e90deb 100644
--- a/drivers/gpu/drm/i915/display/skl_universal_plane.c
+++ b/drivers/gpu/drm/i915/display/skl_universal_plane.c
@@ -1627,7 +1627,7 @@ static int skl_check_main_surface(struct intel_plane_state *plane_state)
 	u32 offset;
 	int ret;
 
-	if (w > max_width || w < min_width || h > max_height) {
+	if (w > max_width || w < min_width || h > max_height || h < 1) {
 		drm_dbg_kms(&dev_priv->drm,
 			    "requested Y/RGB source size %dx%d outside limits (min: %dx1 max: %dx%d)\n",
 			    w, h, min_width, max_width, max_height);
-- 
2.39.0.314.g84b9a713c41-goog


WARNING: multiple messages have this Message-ID (diff)
From: Drew Davenport <ddavenport@chromium.org>
To: intel-gfx@lists.freedesktop.org
Cc: dri-devel@lists.freedesktop.org,
	"Thomas Zimmermann" <tzimmermann@suse.de>,
	linux-kernel@vger.kernel.org, "Daniel Vetter" <daniel@ffwll.ch>,
	"Rodrigo Vivi" <rodrigo.vivi@intel.com>,
	"Drew Davenport" <ddavenport@chromium.org>,
	"David Airlie" <airlied@gmail.com>,
	"Juha-Pekka Heikkilä" <juha-pekka.heikkila@intel.com>
Subject: [Intel-gfx] [PATCH] drm/i915/display: Check source height is > 0
Date: Mon, 26 Dec 2022 22:53:24 -0700	[thread overview]
Message-ID: <20221226225246.1.I15dff7bb5a0e485c862eae61a69096caf12ef29f@changeid> (raw)

The error message suggests that the height of the src rect must be at
least 1. Reject source with height of 0.

Signed-off-by: Drew Davenport <ddavenport@chromium.org>

---
I was investigating some divide-by-zero crash reports on ChromeOS which
pointed to the intel_adjusted_rate function. Further prodding showed
that I could reproduce this in a simple test program if I made src_h
some value less than 1 but greater than 0.

This seemed to be a sensible place to check that the source height is at
least 1. I tried to repro this issue on an amd device I had on hand, and
the configuration was rejected.

Would it make sense to add a check that source dimensions are at least 1
somewhere in core, like in drm_atomic_plane_check? Or is that a valid
use case on some devices, and thus any such check should be done on a
per-driver basis?

Thanks.

 drivers/gpu/drm/i915/display/skl_universal_plane.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/display/skl_universal_plane.c b/drivers/gpu/drm/i915/display/skl_universal_plane.c
index 4b79c2d2d6177..9b172a1e90deb 100644
--- a/drivers/gpu/drm/i915/display/skl_universal_plane.c
+++ b/drivers/gpu/drm/i915/display/skl_universal_plane.c
@@ -1627,7 +1627,7 @@ static int skl_check_main_surface(struct intel_plane_state *plane_state)
 	u32 offset;
 	int ret;
 
-	if (w > max_width || w < min_width || h > max_height) {
+	if (w > max_width || w < min_width || h > max_height || h < 1) {
 		drm_dbg_kms(&dev_priv->drm,
 			    "requested Y/RGB source size %dx%d outside limits (min: %dx1 max: %dx%d)\n",
 			    w, h, min_width, max_width, max_height);
-- 
2.39.0.314.g84b9a713c41-goog


             reply	other threads:[~2022-12-27  5:53 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-12-27  5:53 Drew Davenport [this message]
2022-12-27  5:53 ` [Intel-gfx] [PATCH] drm/i915/display: Check source height is > 0 Drew Davenport
2022-12-27  5:53 ` Drew Davenport
2022-12-27 15:42 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork
2022-12-27 17:55 ` [Intel-gfx] [PATCH] " Teres Alexis, Alan Previn
2022-12-27 17:55   ` Teres Alexis, Alan Previn
2022-12-27 17:55   ` Teres Alexis, Alan Previn
2023-01-11 18:47   ` Drew Davenport
2023-01-11 18:47     ` Drew Davenport
2023-01-11 18:47     ` Drew Davenport
2022-12-27 19:34 ` [Intel-gfx] ✓ Fi.CI.IGT: success for " Patchwork
2023-01-03 10:42 ` [PATCH] " Juha-Pekka Heikkila
2023-01-03 10:42   ` [Intel-gfx] " Juha-Pekka Heikkila
2023-01-03 10:42   ` Juha-Pekka Heikkila
2023-01-10 20:30   ` Drew Davenport
2023-01-10 20:30     ` Drew Davenport
2023-01-10 20:30     ` [Intel-gfx] " Drew Davenport
2023-01-03 10:56 ` [Intel-gfx] ✗ Fi.CI.BUILD: failure for drm/i915/display: Check source height is > 0 (rev2) Patchwork
2023-01-12 18:28 ` [PATCH] drm/i915/display: Check source height is > 0 Ville Syrjälä
2023-01-12 18:28   ` Ville Syrjälä
2023-01-12 18:28   ` [Intel-gfx] " Ville Syrjälä
2023-01-13 11:06   ` Juha-Pekka Heikkila
2023-01-13 11:06     ` Juha-Pekka Heikkila
2023-01-13 11:06     ` Juha-Pekka Heikkila

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221226225246.1.I15dff7bb5a0e485c862eae61a69096caf12ef29f@changeid \
    --to=ddavenport@chromium.org \
    --cc=airlied@gmail.com \
    --cc=daniel@ffwll.ch \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=imre.deak@intel.com \
    --cc=intel-gfx@lists.freedesktop.org \
    --cc=jani.nikula@linux.intel.com \
    --cc=joonas.lahtinen@linux.intel.com \
    --cc=jose.souza@intel.com \
    --cc=juha-pekka.heikkila@intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=matthew.d.roper@intel.com \
    --cc=rodrigo.vivi@intel.com \
    --cc=tvrtko.ursulin@linux.intel.com \
    --cc=tzimmermann@suse.de \
    --cc=ville.syrjala@linux.intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.