The amount of data wanted by the userspace caller is encoded in the
ioctl number. Generic drm ioctls were ignoring it.
As a result, Intel Xorg driver didn't work for i386 userspace on x86_64
kernel on some systems. sizeof(struct drm_mode_get_connector) is 76
bytes on i686 and 80 bytes on x86_64 due to the tail alignment (the data
positions match). The userspace was using the 4 bytes after the
structure to hold the result of the ioctl. Since drm_ioctl() was
copying 80 bytes instead of 76, it was clobbering that data.
A workaround has been committed to xf86-video-intel.
Signed-off-by: Pavel Roskin <proski@xxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---
drivers/gpu/drm/drm_drv.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index e572dd2..8a1c721 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -403,8 +403,11 @@ long drm_ioctl(struct file *filp,
}
else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
ioctl = &drm_ioctls[nr];
+ usize = _IOC_SIZE(cmd);
cmd = ioctl->cmd;
- usize = asize = _IOC_SIZE(cmd);
+ asize = _IOC_SIZE(cmd);
+ if (unlikely(usize > asize))
+ usize = asize;
} else
goto err_i1;
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/dri-devel
