linux-kernel - Re: [PATCH v2] drm: refuse ADDFB2 ioctl for broken bigendian drivers

Open Source and information security mailing list archives

Date:   Fri, 7 Sep 2018 21:47:39 +0200
From:   Daniel Vetter <daniel@...ll.ch>
To:     Gerd Hoffmann <kraxel@...hat.com>
Cc:     dri-devel@...ts.freedesktop.org, David Airlie <airlied@...ux.ie>,
        open list <linux-kernel@...r.kernel.org>,
        Sean Paul <sean@...rly.run>
Subject: Re: [PATCH v2] drm: refuse ADDFB2 ioctl for broken bigendian drivers

On Fri, Sep 07, 2018 at 09:32:13AM +0200, Gerd Hoffmann wrote:
> Drivers must set the quirk_addfb_prefer_host_byte_order quirk to make
> the drm_mode_addfb() compat code work correctly on bigendian machines.
> 
> If they don't they interpret pixel_format values incorrectly for bug
> compatibility, which in turn implies the ADDFB2 ioctl does not work
> correctly then.  So block it to make userspace fallback to ADDFB.
> 
> Signed-off-by: Gerd Hoffmann <kraxel@...hat.com>

Reviewed-by: Daniel Vetter <daniel.vetter@...ll.ch>

> ---
>  drivers/gpu/drm/drm_crtc_internal.h |  6 ++++--
>  drivers/gpu/drm/drm_framebuffer.c   | 24 ++++++++++++++++++++++++
>  drivers/gpu/drm/drm_ioctl.c         |  2 +-
>  3 files changed, 29 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_crtc_internal.h b/drivers/gpu/drm/drm_crtc_internal.h
> index b613227633..6719e1c8df 100644
> --- a/drivers/gpu/drm/drm_crtc_internal.h
> +++ b/drivers/gpu/drm/drm_crtc_internal.h
> @@ -174,6 +174,8 @@ void drm_fb_release(struct drm_file *file_priv);
>  
>  int drm_mode_addfb(struct drm_device *dev, struct drm_mode_fb_cmd *or,
>  		   struct drm_file *file_priv);
> +int drm_mode_addfb2(struct drm_device *dev,
> +		    void *data, struct drm_file *file_priv);
>  int drm_mode_rmfb(struct drm_device *dev, u32 fb_id,
>  		  struct drm_file *file_priv);
>  
> @@ -181,8 +183,8 @@ int drm_mode_rmfb(struct drm_device *dev, u32 fb_id,
>  /* IOCTL */
>  int drm_mode_addfb_ioctl(struct drm_device *dev,
>  			 void *data, struct drm_file *file_priv);
> -int drm_mode_addfb2(struct drm_device *dev,
> -		    void *data, struct drm_file *file_priv);
> +int drm_mode_addfb2_ioctl(struct drm_device *dev,
> +			  void *data, struct drm_file *file_priv);
>  int drm_mode_rmfb_ioctl(struct drm_device *dev,
>  			void *data, struct drm_file *file_priv);
>  int drm_mode_getfb(struct drm_device *dev,
> diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
> index f863f8a20f..fb7528444c 100644
> --- a/drivers/gpu/drm/drm_framebuffer.c
> +++ b/drivers/gpu/drm/drm_framebuffer.c
> @@ -363,6 +363,30 @@ int drm_mode_addfb2(struct drm_device *dev,
>  	return 0;
>  }
>  
> +int drm_mode_addfb2_ioctl(struct drm_device *dev,
> +			  void *data, struct drm_file *file_priv)
> +{
> +#ifdef __BIG_ENDIAN
> +	if (!dev->mode_config.quirk_addfb_prefer_host_byte_order) {
> +		/*
> +		 * Drivers must set the
> +		 * quirk_addfb_prefer_host_byte_order quirk to make
> +		 * the drm_mode_addfb() compat code work correctly on
> +		 * bigendian machines.
> +		 *
> +		 * If they don't they interpret pixel_format values
> +		 * incorrectly for bug compatibility, which in turn
> +		 * implies the ADDFB2 ioctl does not work correctly
> +		 * then.  So block it to make userspace fallback to
> +		 * ADDFB.
> +		 */
> +		DRM_DEBUG_KMS("addfb2 broken on bigendian");
> +		return -EINVAL;
> +	}
> +#endif
> +	return drm_mode_addfb2(dev, data, file_priv);
> +}
> +
>  struct drm_mode_rmfb_work {
>  	struct work_struct work;
>  	struct list_head fbs;
> diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
> index ea10e9a26a..6b4a633b42 100644
> --- a/drivers/gpu/drm/drm_ioctl.c
> +++ b/drivers/gpu/drm/drm_ioctl.c
> @@ -645,7 +645,7 @@ static const struct drm_ioctl_desc drm_ioctls[] = {
>  	DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETPROPBLOB, drm_mode_getblob_ioctl, DRM_UNLOCKED),
>  	DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETFB, drm_mode_getfb, DRM_UNLOCKED),
>  	DRM_IOCTL_DEF(DRM_IOCTL_MODE_ADDFB, drm_mode_addfb_ioctl, DRM_UNLOCKED),
> -	DRM_IOCTL_DEF(DRM_IOCTL_MODE_ADDFB2, drm_mode_addfb2, DRM_UNLOCKED),
> +	DRM_IOCTL_DEF(DRM_IOCTL_MODE_ADDFB2, drm_mode_addfb2_ioctl, DRM_UNLOCKED),
>  	DRM_IOCTL_DEF(DRM_IOCTL_MODE_RMFB, drm_mode_rmfb_ioctl, DRM_UNLOCKED),
>  	DRM_IOCTL_DEF(DRM_IOCTL_MODE_PAGE_FLIP, drm_mode_page_flip_ioctl, DRM_MASTER|DRM_UNLOCKED),
>  	DRM_IOCTL_DEF(DRM_IOCTL_MODE_DIRTYFB, drm_mode_dirtyfb_ioctl, DRM_MASTER|DRM_UNLOCKED),
> -- 
> 2.9.3
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@...ts.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives