linux-kernel - Re: [PATCH] drm/fb-helper: Only reject FB changes if FB_MISC_USER_EVENT is set

Open Source and information security mailing list archives

Message-ID: <87d59360-8419-b547-7b6b-32afedcf1330@daenzer.net>
Date:   Fri, 17 Mar 2017 18:01:41 +0900
From:   Michel Dänzer <michel@...nzer.net>
To:     Ville Syrjälä <ville.syrjala@...ux.intel.com>
Cc:     linux-kernel@...r.kernel.org, dri-devel@...ts.freedesktop.org,
        Stefan Agner <stefan@...er.ch>
Subject: Re: [PATCH] drm/fb-helper: Only reject FB changes if
 FB_MISC_USER_EVENT is set

On 16/03/17 07:09 PM, Ville Syrjälä wrote:
> On Thu, Mar 16, 2017 at 06:55:53PM +0900, Michel Dänzer wrote:
>> From: Michel Dänzer <michel.daenzer@....com>
>>
>> Otherwise this can also prevent modesets e.g. for switching VTs.
>>
>> FB_MISC_USER_EVENT is set when the request originates from userspace,
>> which is what we're interested in here according to the DRM_DEBUG
>> output.
> 
> So why is the kernel allowed to violate this?
> 
> The checks look somewhat bogus to me anyway. The 'virtual size == fb size'
> check makes some kind of sense. Although I don't see why the virtual
> resolution couldn't be smaller than the fb size. But requiring that the
> visible resolutionn matches the fb size as well definitely seems wrong.

Agreed on all counts. So, I think what's needed is almost a revert of
865afb11949e, except for the bits_per_pixel comparison, since we really
can't change that. See diff below.

Does that make sense? Stefan, would this break any test case you wrote
your patch for?

diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index f6d4d9700734..f4f70ce24fcc 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1260,8 +1260,8 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
         * to KMS, hence fail if different settings are requested.
         */
        if (var->bits_per_pixel != fb->format->cpp[0] * 8 ||
-           var->xres != fb->width || var->yres != fb->height ||
-           var->xres_virtual != fb->width || var->yres_virtual != fb->height) {
+           var->xres > fb->width || var->yres > fb->height ||
+           var->xres_virtual > fb->width || var->yres_virtual > fb->height) {
                DRM_DEBUG("fb userspace requested width/height/bpp different than current fb "
                          "request %dx%d-%d (virtual %dx%d) > %dx%d-%d\n",
                          var->xres, var->yres, var->bits_per_pixel,



>> Bugzilla: https://bugs.freedesktop.org/99841
>> Fixes: 865afb11949e ("drm/fb-helper: reject any changes to the fbdev")
>> Signed-off-by: Michel Dänzer <michel.daenzer@....com>
>> ---
>>
>> I'm not entirely sure why the values can not match for a VT switch. If
>> anybody thinks this just papers over the real issue, please speak up.
>>
>>  drivers/gpu/drm/drm_fb_helper.c | 7 ++++---
>>  1 file changed, 4 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
>> index f6d4d9700734..9663f3b8f287 100644
>> --- a/drivers/gpu/drm/drm_fb_helper.c
>> +++ b/drivers/gpu/drm/drm_fb_helper.c
>> @@ -1259,9 +1259,10 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
>>  	 * Changes struct fb_var_screeninfo are currently not pushed back
>>  	 * to KMS, hence fail if different settings are requested.
>>  	 */
>> -	if (var->bits_per_pixel != fb->format->cpp[0] * 8 ||
>> -	    var->xres != fb->width || var->yres != fb->height ||
>> -	    var->xres_virtual != fb->width || var->yres_virtual != fb->height) {
>> +	if ((info->flags & FBINFO_MISC_USEREVENT) &&
>> +	    (var->bits_per_pixel != fb->format->cpp[0] * 8 ||
>> +	     var->xres != fb->width || var->yres != fb->height ||
>> +	     var->xres_virtual != fb->width || var->yres_virtual != fb->height)) {
>>  		DRM_DEBUG("fb userspace requested width/height/bpp different than current fb "
>>  			  "request %dx%d-%d (virtual %dx%d) > %dx%d-%d\n",
>>  			  var->xres, var->yres, var->bits_per_pixel,
>> -- 
>> 2.11.0
>>
>> _______________________________________________
>> dri-devel mailing list
>> dri-devel@...ts.freedesktop.org
>> https://lists.freedesktop.org/mailman/listinfo/dri-devel
> 


-- 
Earthling Michel Dänzer               |               http://www.amd.com
Libre software enthusiast             |             Mesa and X developer



lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives