From patchwork Thu Jan 23 12:53:15 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Herrmann X-Patchwork-Id: 3528591 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 821079F2D6 for ; Thu, 23 Jan 2014 12:53:30 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id BDEE520115 for ; Thu, 23 Jan 2014 12:53:29 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id AFBE120108 for ; Thu, 23 Jan 2014 12:53:28 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id D709AFBEC4; Thu, 23 Jan 2014 04:53:26 -0800 (PST) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-we0-f172.google.com (mail-we0-f172.google.com [74.125.82.172]) by gabe.freedesktop.org (Postfix) with ESMTP id AC492FBEC4 for ; Thu, 23 Jan 2014 04:53:25 -0800 (PST) Received: by mail-we0-f172.google.com with SMTP id q58so1108655wes.17 for ; Thu, 23 Jan 2014 04:53:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Stidcdrl+G2OWjxZoVUH3ZWqKrXJnXBqfOmHs3iWc6k=; b=H7xcQ6NgY3fCKjMgJGPOCwTIW3ZotgixdbI8OXQlGPvsGhuO8Vpi2CT9nlngPruQF9 EFFblUkgnHJWtxmZwU3gCy58IPg7OwGmWg9NNqA9N10nYFUThdM5NHdJkqmUso4WPCng bcmmPY+ttL48CHPYh6idMHvS8Nlkh0UwRGt7MJB7oRR1QZcSwDMrm+EZs3p+0O2bp20F vI6h69HZY11y1sy5Wz5X2Tu0ETpZRHp6qUE4CQzwZqogs680C5p5XOjPJFYjo3PDS5YB Mt4ZX2LlfTNC6vS9qifTW4YD9frAJWKRG102isbKyAKxkQplsf2YwL6svFJBkzmn5bu8 ujmQ== X-Received: by 10.180.79.106 with SMTP id i10mr7652952wix.23.1390481603663; Thu, 23 Jan 2014 04:53:23 -0800 (PST) Received: from david-ub.localdomain (stgt-5f71be19.pool.mediaWays.net. [95.113.190.25]) by mx.google.com with ESMTPSA id uc9sm27605117wib.2.2014.01.23.04.53.21 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 23 Jan 2014 04:53:22 -0800 (PST) From: David Herrmann To: dri-devel@lists.freedesktop.org Subject: [PATCH v2 5/6] drm/crtc: add sanity checks to create_dumb() Date: Thu, 23 Jan 2014 13:53:15 +0100 Message-Id: <1390481595-512-1-git-send-email-dh.herrmann@gmail.com> X-Mailer: git-send-email 1.8.5.3 In-Reply-To: <1390245989-13280-6-git-send-email-dh.herrmann@gmail.com> References: <1390245989-13280-6-git-send-email-dh.herrmann@gmail.com> Cc: Daniel Vetter X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: dri-devel-bounces@lists.freedesktop.org Errors-To: dri-devel-bounces@lists.freedesktop.org X-Spam-Status: No, score=-4.6 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Lets make sure some basic expressions are always true: bpp != NULL width != NULL height != NULL stride = bpp * width < 2^32 size = stride * height < 2^32 PAGE_ALIGN(size) < 2^32 At least the udl driver doesn't check for multiplication-overflows, so lets just make sure it will never happen. These checks allow drivers to do any 32bit math without having to test for mult-overflows themselves. The two divisions might hurt performance a bit, but dumb_create() is only used for scanout-buffers, so that should be fine. We could use 64bit math to avoid the divisions, but that may be slow on 32bit machines.. Or maybe there should just be a "safe_mult32()" helper, which currently doesn't exist (I think?). Reviewed-by: Daniel Vetter Signed-off-by: David Herrmann --- drivers/gpu/drm/drm_crtc.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index 266a01d..2b50702 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -3738,9 +3738,26 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv) { struct drm_mode_create_dumb *args = data; + u32 cpp, stride, size; if (!dev->driver->dumb_create) return -ENOSYS; + if (!args->width || !args->height || !args->bpp) + return -EINVAL; + + /* overflow checks for 32bit size calculations */ + cpp = DIV_ROUND_UP(args->bpp, 8); + if (cpp > 0xffffffffU / args->width) + return -EINVAL; + stride = cpp * args->width; + if (args->height > 0xffffffffU / stride) + return -EINVAL; + + /* test for wrap-around */ + size = args->height * stride; + if (PAGE_ALIGN(size) == 0) + return -EINVAL; + return dev->driver->dumb_create(file_priv, dev, args); }