linux-toradex.git/drivers/gpu/drm/drm_crtc.c, branch v3.2.68

drm: fix DRM_IOCTL_MODE_GETFB handle-leak

2015-01-01T01:27:51+00:00

commit 101b96f32956ee99bf1468afaf572b88cda9f88b upstream.

DRM_IOCTL_MODE_GETFB is used to retrieve information about a given
framebuffer ID. It is a read-only helper and was thus declassified for
unprivileged access in:

  commit a14b1b42477c5ef089fcda88cbaae50d979eb8f9
  Author: Mandeep Singh Baines 
  Date:   Fri Jan 20 12:11:16 2012 -0800

      drm: remove master fd restriction on mode setting getters

However, alongside width, height and stride information,
DRM_IOCTL_MODE_GETFB also passes back a handle to the underlying buffer of
the framebuffer. This handle allows users to mmap() it and read or write
into it. Obviously, this should be restricted to DRM-Master.

With the current setup, *any* process with access to /dev/dri/card0 (which
means any process with access to hardware-accelerated rendering) can
access the current screen framebuffer and modify it ad libitum.

For backwards-compatibility reasons we want to keep the
DRM_IOCTL_MODE_GETFB call unprivileged. Besides, it provides quite useful
information regarding screen setup. So we simply test whether the caller
is the current DRM-Master and if not, we return 0 as handle, which is
always invalid. A following DRM_IOCTL_GEM_CLOSE on this handle will fail
with EINVAL, but we accept this. Users shouldn't test for errors during
GEM_CLOSE, anyway. And it is still better as a failing MODE_GETFB call.

v2: add capable(CAP_SYS_ADMIN) check for compatibility with i-g-t

Signed-off-by: David Herrmann 
Reviewed-by: Chris Wilson 
Signed-off-by: Dave Airlie 
[bwh: Backported to 3.2:
 - drm_framebuffer_funcs::create_handle must be non-null
 - Adjust context, indentation]
Signed-off-by: Ben Hutchings

drm: Check for invalid cursor flags

2012-09-19T14:04:33+00:00

commit 7c4eaca4162d0b5ad4fb39f974d7ffd71b9daa09 upstream.

Signed-off-by: Jakob Bornecrantz 
Signed-off-by: Dave Airlie 
Signed-off-by: Ben Hutchings

drm: remove some potentially dangerous DRM_ERRORs

2012-09-19T14:04:33+00:00

commit acb4b992d8a13728044f430b47b9199aa45993e9 upstream.

Each of these error messages can be caused by a broken or malicious
userspace wanting to spam the dmesg with useless info.  They're really
not worthy of DRM_DEBUG statements either; those are generally only
useful during bringup of new hardware or versions, and ought to be
removed before going upstream anyway.

Signed-off-by: Jesse Barnes 
Reviewed-by: Alex Deucher 
Signed-off-by: Dave Airlie 
[bwh: Backported to 3.2: s/r\./r->/ in drm_mode_addfb()]
Signed-off-by: Ben Hutchings

drm: integer overflow in drm_mode_dirtyfb_ioctl()

2011-11-23T08:59:28+00:00

There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
if userspace passes in a large num_clips.  The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result
in a memory corruption.

Reported-by: Haogang Chen 
Signed-off-by: Xi Wang 
Cc: stable@kernel.org
Signed-off-by: Dave Airlie

drm: Ensure string is null terminated.

2011-11-11T10:59:15+00:00

Fixes Coverity buffer not null terminated defect.

Signed-off-by: Vinson Lee 
Signed-off-by: Dave Airlie

Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux

2011-11-07T18:01:56+00:00

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (40 commits)
  vmwgfx: Snoop DMA transfers with non-covering sizes
  vmwgfx: Move the prefered mode first in the list
  vmwgfx: Unreference surface on cursor error path
  vmwgfx: Free prefered mode on error path
  vmwgfx: Use pointer return error codes
  vmwgfx: Fix hw cursor position
  vmwgfx: Infrastructure for explicit placement
  vmwgfx: Make the preferred autofit mode have a 60Hz vrefresh
  vmwgfx: Remove screen object active list
  vmwgfx: Screen object cleanups
  drm/radeon/kms: consolidate GART code, fix segfault after GPU lockup V2
  drm/radeon/kms: don't poll forever if MC GDDR link training fails
  drm/radeon/kms: fix DP setup on TRAVIS bridges
  drm/radeon/kms: set HPD polarity in hpd_init()
  drm/radeon/kms: add MSI module parameter
  drm/radeon/kms: Add MSI quirk for Dell RS690
  drm/radeon/kms: Add MSI quirk for HP RS690
  drm/radeon/kms: split MSI check into a separate function
  vmwgfx: Reinstate the update_layout ioctl
  drm/radeon/kms: always do extended edid probe
  ...

drm: Introduce "Virtual" connectors and encoders

2011-11-01T16:01:42+00:00

This will allow us to attach various properties specific to virtual
monitors in the future.

Note that we don't export an EDID property for "Virtual" connectors.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Jakob Bornecrantz 
Signed-off-by: Dave Airlie

gpu: Add export.h as required to drivers/gpu files.

2011-10-31T23:32:03+00:00

They need this to get all the EXPORT_SYMBOL variants and THIS_MODULE

Signed-off-by: Paul Gortmaker

drm: Fix the number of connector and encoder to cleanup functions

2011-08-29T10:47:35+00:00

It is left out the code to decrease the number of connector and encoder
to the cleanup functions.

Signed-off-by: Joonyoung Shim 
Signed-off-by: Kyungmin Park 
Signed-off-by: Dave Airlie

drm/kms: allow drm_mode_group with no objects

2011-07-07T07:49:00+00:00

Sometimes we could be controlling a device (such as an NVIDIA Tesla) that
has no crtcs/encoders/connectors.

One could argue that the driver should unset DRIVER_MODESET in this case,
but that changes a whole heap of the DRM's other behaviours, and it's much
easier to just be a modesetting driver without any outputs.

Signed-off-by: Ben Skeggs 
Signed-off-by: Dave Airlie