linux-kernel - Re: [PATCH v2] drm/core: Fail atomic IOCTL with no CRTC state but with signaling.

Open Source and information security mailing list archives

Message-ID: <20170627150108.dennwzqhmgbqmsbn@phenom.ffwll.local>
Date:   Tue, 27 Jun 2017 17:01:08 +0200
From:   Daniel Vetter <daniel@...ll.ch>
To:     Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>
Cc:     Harry Wentland <harry.wentland@....com>,
        Andrey Grodzovsky <Andrey.Grodzovsky@....com>,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
        intel-gfx@...ts.freedesktop.org, amd-gfx@...ts.freedesktop.org,
        seanpaul@...omium.org
Subject: Re: [PATCH v2] drm/core: Fail atomic IOCTL with no CRTC state but
 with signaling.

On Tue, Jun 27, 2017 at 04:29:44PM +0200, Maarten Lankhorst wrote:
> Op 27-06-17 om 09:37 schreef Daniel Vetter:
> > On Mon, Jun 26, 2017 at 03:44:07PM -0400, Harry Wentland wrote:
> >> On 2017-06-20 01:57 PM, Andrey Grodzovsky wrote:
> >>> Problem : While running IGT kms_atomic_transition test suite i encountered
> >>> a hang in drmHandleEvent immediately following  an atomic_commit.
> >>> After dumping the atomic state I relized that in this case there was
> >>> not even one CRTC attached to the state and only disabled
> >>> planes. This probably due to a commit which hadn't changed any property
> >>> which would require attaching crtc state. This means drmHandleEvent
> >>> will never wake up from read since without CRTC in atomic state
> >>> the event fd will not be signaled.
> >>>
> >>> Fix: Protect against this issue by failing atomic_commit early in
> >>> drm_mode_atomic_commit where such probelm can be identified.
> >>>
> >>> v2:
> >>> Fix typos and extra newlines.
> >>>
> >>> Change-Id: I3ee28ffae35fd1e8bfe553146c44da53da02e6f8
> >>> Signed-off-by: Andrey Grodzovsky <Andrey.Grodzovsky@....com>
> >> Reviewed-by: Harry Wentland <harry.wentland@....com>
> > Stalling on this hoping for the igt patch. Does it exist already?
> > -Daniel
> >
> >> Harry
> >>
> >>> ---
> >>>  drivers/gpu/drm/drm_atomic.c | 11 ++++++++++-
> >>>  1 file changed, 10 insertions(+), 1 deletion(-)
> >>>
> >>> diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
> >>> index a567310..48145bf 100644
> >>> --- a/drivers/gpu/drm/drm_atomic.c
> >>> +++ b/drivers/gpu/drm/drm_atomic.c
> >>> @@ -1933,7 +1933,7 @@ static int prepare_crtc_signaling(struct drm_device *dev,
> >>>  {
> >>>  	struct drm_crtc *crtc;
> >>>  	struct drm_crtc_state *crtc_state;
> >>> -	int i, ret;
> >>> +	int i, c = 0, ret;
> >>>  
> >>>  	if (arg->flags & DRM_MODE_ATOMIC_TEST_ONLY)
> >>>  		return 0;
> >>> @@ -1994,8 +1994,17 @@ static int prepare_crtc_signaling(struct drm_device *dev,
> >>>  
> >>>  			crtc_state->event->base.fence = fence;
> >>>  		}
> >>> +
> >>> +		c++;
> >>>  	}
> >>>  
> >>> +	/*
> >>> +	 * Having this flag means user mode pends on event which will never
> >>> +	 * reach due to lack of at least one CRTC for signaling
> >>> +	 */
> >>> +	if (c == 0 && (arg->flags & DRM_MODE_PAGE_FLIP_EVENT))
> >>> +		return -EINVAL;
> >>> +
> >>>  	return 0;
> >>>  }
> >>>  
> >>>
> Just do it, and I'll commit this to igt?

Ack on both the kernel patch and the igt patch, feel free to push them
both with:

Acked-by: Daniel Vetter <daniel.vetter@...ll.ch>

If you do, please add the Testcase: line to the kernel patch.

Thanks, Daniel

> 
> diff --git a/tests/kms_atomic.c b/tests/kms_atomic.c
> index 6375fede7179..77429b3db384 100644
> --- a/tests/kms_atomic.c
> +++ b/tests/kms_atomic.c
> @@ -1205,6 +1205,15 @@ static void crtc_invalid_params(struct kms_atomic_crtc_state *crtc_old,
>  	crtc_commit_atomic(&crtc, plane, req, ATOMIC_RELAX_NONE,
>  			   DRM_MODE_ATOMIC_TEST_ONLY);
>  
> +	/*
> +	 * TEST_ONLY cannot be combined with DRM_MODE_PAGE_FLIP_EVENT,
> +	 * but DRM_MODE_PAGE_FLIP_EVENT will always generate EINVAL
> +	 * without valid crtc, so test it here.
> +	 */
> +	crtc_commit_atomic_err(&crtc, plane, req, ATOMIC_RELAX_NONE,
> +			       DRM_MODE_ATOMIC_TEST_ONLY | DRM_MODE_PAGE_FLIP_EVENT,
> +			       EINVAL);
> +
>  	/* Create a blob which is the wrong size to be a valid mode. */
>  	do_or_die(drmModeCreatePropertyBlob(crtc.state->desc->fd,
>  					    crtc.mode.data,
> @@ -1356,12 +1365,12 @@ static void atomic_invalid_params(struct kms_atomic_crtc_state *crtc,
>  	/* Valid pointers, but still should copy nothing. */
>  	do_ioctl(desc->fd, DRM_IOCTL_MODE_ATOMIC, &ioc);
>  
> -	/* Nonsense flags. */
> -	ioc.flags = 0xdeadbeef;
> +	/* Valid noop, but with event set should fail. */
> +	ioc.flags = DRM_MODE_PAGE_FLIP_EVENT;
>  	do_ioctl_err(desc->fd, DRM_IOCTL_MODE_ATOMIC, &ioc, EINVAL);
>  
> -	/* Specifically forbidden combination. */
> -	ioc.flags = DRM_MODE_ATOMIC_TEST_ONLY | DRM_MODE_PAGE_FLIP_EVENT;
> +	/* Nonsense flags. */
> +	ioc.flags = 0xdeadbeef;
>  	do_ioctl_err(desc->fd, DRM_IOCTL_MODE_ATOMIC, &ioc, EINVAL);
>  
>  	ioc.flags = 0;
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@...ts.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives