linux-kernel - Re: [RFC PATCH] vmwgfx: Fix assignment in vmw_framebuffer_create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 27 Jan 2012 15:28:54 +0100
From:	Thomas Hellstrom <thellstrom@...are.com>
To:	Jakob Bornecrantz <jakob@...are.com>
CC:	airlied@...ux.ie, airlied@...hat.com,
	dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
	joe Perches <joe@...ches.com>, Ryan Mallon <rmallon@...il.com>
Subject: Re: [RFC PATCH] vmwgfx: Fix assignment in vmw_framebuffer_create_handle

On 01/27/2012 03:24 PM, Jakob Bornecrantz wrote:
> I was asking around and this seems to only be used by X when it
> starts and we want to preserve the contents of the screen. That
> feature is implemented by the X driver. So we need to figure how we
> want to solve it.
>
> Either way this fix should probably go into this RC series, not
> sure if we need to send this to stable, since we are not leaking
> data to userspace (check drm_mode_getfb), but we might as well.
>
> Reviewed-by: Jakob Bornecrantz<jakob@...are.com>

But shouldn't we return the *real* handle. Not 0??

/Thomas




>
> Cheers, Jakob.
>
> ----- Original Message -----
>> Ryan,
>>
>> Thanks for pointing this out. Unfortunately there  seems to be two
>> bugs here, the one you pointed out and the fact that we set the handle
>> to zero, when it probably should be set to struct
>> vmw_framebuffer::user_handle.
>>
>> Jakob, can you comment on this?
>>
>> /Thomas
>>
>> On 01/27/2012 07:25 AM, Ryan Mallon wrote:
>>> The assignment of handle in vmw_framebuffer_create_handle doesn't
>>> actually do anything useful and is incorrectly assigning an integer
>>> value to a pointer argument. It appears that this is a typo and
>>> should
>>> be dereferencing handle rather than assigning to it directly.
>>>
>>> Signed-off-by: Ryan Mallon<rmallon@...il.com>
>>> ---
>>>
>>> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
>>> b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
>>> index 0af6ebd..b66ef0e 100644
>>> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
>>> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
>>> @@ -378,7 +378,7 @@ int vmw_framebuffer_create_handle(struct
>>> drm_framebuffer *fb,
>>>    				  unsigned int *handle)
>>>    {
>>>    	if (handle)
>>> -		handle = 0;
>>> +		*handle = 0;
>>>
>>>    	return 0;
>>>    }
>>>
>>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/