All of lore.kernel.org
 help / color / mirror / Atom feed
From: Hans de Goede <hdegoede@redhat.com>
To: Daniel Vetter <daniel@ffwll.ch>, Zack Rusin <zackr@vmware.com>
Cc: Hans de Goede <hdegoede@redhat.com>,
	Linux-graphics-maintainer <Linux-graphics-maintainer@vmware.com>,
	dri-devel@lists.freedesktop.org
Subject: [PATCH] drm/vmwgfx: Fix passing partly uninitialized drm_mode_fb_cmd2 struct
Date: Mon,  9 May 2022 13:04:25 +0200	[thread overview]
Message-ID: <20220509110425.165537-1-hdegoede@redhat.com> (raw)

vmw_fb_kms_framebuffer() declares a drm_mode_fb_cmd2 struct on the stack
without zero-ing it and then continues with initializing only some fields.

This leads to drm_mode_fb_cmd2.modifiers[0] containing garbage,
which eventually gets used by drm_helper_mode_fill_fb_struct() to
set fb->modifier when leads to the following atomic-check failure:

vmwgfx 0000:00:02.0: [drm:drm_atomic_check_only] [PLANE:34:plane-0]
 invalid pixel format XR24 little-endian (0x34325258),
 modifier 0xffff94d64719e000
fbcon_init: detected unhandled fb_set_par error, error code -22

Which causes the fbdev emulation and thus also fbcon to not work.

Initialize the struct with all zeros to fix this.

Fixes: dabdcdc9822a ("drm/vmwgfx: Switch to mode_cmd2")
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=2072556
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
---
While working on this I noticed that at least the vmwgfx_fb.c code
has a tendency to declare structs on the stack without zero-ing
them, instead relying on manually initializing all the fields.
Specifically struct drm_mode_set is used multiple times like this
and there also is an occurence of struct drm_clip being used
like this, but that one is less worrying.

This is a bad idea because some of these structs may get new fields
added later. Someone really should do an audit of the entire
vmwgfx code for this pattern and make sure all structs declared
on the stack are zero-ed before use.
---
 drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index 8ee34576c7d0..7509013818ba 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -483,7 +483,7 @@ static int vmw_fb_kms_detach(struct vmw_fb_par *par,
 
 static int vmw_fb_kms_framebuffer(struct fb_info *info)
 {
-	struct drm_mode_fb_cmd2 mode_cmd;
+	struct drm_mode_fb_cmd2 mode_cmd = {};
 	struct vmw_fb_par *par = info->par;
 	struct fb_var_screeninfo *var = &info->var;
 	struct drm_framebuffer *cur_fb;
-- 
2.36.0


             reply	other threads:[~2022-05-09 11:04 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-09 11:04 Hans de Goede [this message]
2022-05-09 11:52 ` [PATCH] drm/vmwgfx: Fix passing partly uninitialized drm_mode_fb_cmd2 struct Javier Martinez Canillas
2022-05-09 11:55   ` Hans de Goede
2022-05-09 12:02     ` Javier Martinez Canillas
2022-05-13  7:43       ` Thorsten Leemhuis
2022-05-13 13:25         ` Zack Rusin
2022-05-13 13:47           ` Thorsten Leemhuis
2022-05-13 14:18           ` Hans de Goede
2022-05-13 15:00             ` Zack Rusin
2022-12-21  2:23 Kaiwan N Billimoria
2022-12-21 10:15 ` Thorsten Leemhuis
2022-12-21 14:31   ` Kaiwan N Billimoria

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220509110425.165537-1-hdegoede@redhat.com \
    --to=hdegoede@redhat.com \
    --cc=Linux-graphics-maintainer@vmware.com \
    --cc=daniel@ffwll.ch \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=zackr@vmware.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.