linux-kernel - Re: [PATCH] drm/mediatek: Set sensible cursor width/height values to fix crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <74e7477b-81c7-4713-80cc-1cb476185bc9@collabora.com>
Date: Thu, 18 Jul 2024 12:24:38 +0200
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>
To: Fei Shao <fshao@...omium.org>, Chen-Yu Tsai <wenst@...omium.org>
Cc: chunkuang.hu@...nel.org, p.zabel@...gutronix.de, airlied@...il.com,
 daniel@...ll.ch, matthias.bgg@...il.com, shawn.sung@...iatek.com,
 ck.hu@...iatek.com, dri-devel@...ts.freedesktop.org,
 linux-mediatek@...ts.infradead.org, linux-kernel@...r.kernel.org,
 linux-arm-kernel@...ts.infradead.org, kernel@...labora.com
Subject: Re: [PATCH] drm/mediatek: Set sensible cursor width/height values to
 fix crash

Il 18/07/24 11:27, Fei Shao ha scritto:
> On Thu, Jul 18, 2024 at 4:49 PM Chen-Yu Tsai <wenst@...omium.org> wrote:
>>
>> (CC-ed Fei Shao)
>>
>> On Thu, Jul 18, 2024 at 4:24 PM AngeloGioacchino Del Regno
>> <angelogioacchino.delregno@...labora.com> wrote:
>>>
>>> Hardware-speaking, there is no feature-reduced cursor specific
>>> plane, so this driver reserves the last all Overlay plane as a
>>> Cursor plane, but sets the maximum cursor width/height to the
>>> maximum value that the full overlay plane can use.
>>>
>>> While this could be ok, it raises issues with common userspace
>>> using libdrm (especially Mutter, but other compositors too) which
>>> will crash upon performing allocations and/or using said cursor
>>> plane.
>>>
>>> Reduce the maximum width/height for the cursor to 512x512 pixels,
>>> value taken from IGT's maximum cursor size test, which succeeds.
>>>
>>> Fixes: a4c9410b31ca ("drm/mediatek: Set DRM mode configs accordingly")
>>> Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>
>>> ---
>>>   drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 ++--
>>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
>>> index 6f0b415a978d..b96763664c4f 100644
>>> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
>>> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
>>> @@ -540,8 +540,8 @@ static int mtk_drm_kms_init(struct drm_device *drm)
>>>          }
>>>
>>>          /* IGT will check if the cursor size is configured */
>>> -       drm->mode_config.cursor_width = drm->mode_config.max_width;
>>> -       drm->mode_config.cursor_height = drm->mode_config.max_height;
>>> +       drm->mode_config.cursor_width = 512;
>>> +       drm->mode_config.cursor_height = 512;
>>
>> Fei already did the same (?) workaround downstream just recently.

Heh, didn't know that :-D

> 
> Well, so another userspace gets confused...
> I actually sent a separate userspace (i.e. Chrome) fix where I
> encountered the issue, so I didn't proceed with upstreaming it in the
> end.
> 

Actually, there is a specific recipe that doesn't trigger this bug, that's why
I couldn't trigger it when reviewing the patch that was introducing it; if you
use a module instead of built-in, and insert it right after Panfrost, then you
will get stuff working - but with a performance penalty (and I upgraded my system
right before testing this patch, so I thought it happened because of the upgrade
and not because of this one).

After some more upgrades here and there, and seeing that I was on X11 and not
Wayland as usual, I was able to trigger this bug in any and every condition...

> This matches my preference in [1], so of course I'd like to see it
> merged... if maintainers are okay with it.
> Given I've tested the exact same change before:
> Reviewed-by: Fei Shao <fshao@...omium.org>
> Tested-by: Fei Shao <fshao@...omium.org>
> 

Thanks!

> [1]: https://lore.kernel.org/all/CAC=S1nhKPo5BUYJ_cHGz3OoPrWNh5eO8rhdyikLimsqSOrZ5Xg@mail.gmail.com/
> 
> Regards,
> Fei
>>
>> OOTH, Intel recently added a feature for enumerating "suggested"
>> cursor sizes. See https://patchwork.freedesktop.org/patch/583299/
>>
>> Not sure if other compositors will end up using it or not.

Yeah, that's good, and we might do that as well in MediaTek DRM... in a slightly
different way, as it looks like they are simply hinting the same values as the
mode_config is declaring... while we'd be adding a hint with a sensible size that
is less than the maximum supported one from the overlay.

In reality, here, the issue is that the most popular compositors do not support
overlay planes (as in, they don't use them at all)... my first idea was to remove
the CURSOR plane entirely and declare it as per what it is for real (an OVERLAY),
but that would only give a performance penalty as that'd become yet another unused
plane and nothing else.

If at least the most popular compositors did support overlay planes, I'd have done
that instead... but oh, well!

And anyway I hope that the maintainers are okay with this because, well, otherwise
MediaTek SoCs won't be usable with any popular WM.

Cheers!
Angelo

>>
>> ChenYu
>>
>>>          /* Use OVL device for all DMA memory allocations */
>>>          crtc = drm_crtc_from_index(drm, 0);
>>> --
>>> 2.45.2
>>>