On Wed, Nov 05, 2014 at 02:25:18PM +0100, Thierry Reding wrote: > From: Thierry Reding <treding@xxxxxxxxxx> > > When creating a dumb buffer object using the DRM_IOCTL_MODE_CREATE_DUMB > IOCTL, only the width, height, bpp and flags fields are inputs. The > caller is not guaranteed to zero out or set handle, pitch and size. > Drivers must not treat these values as possible inputs, otherwise they > may use uninitialized memory during the computation of the framebuffer > size. > > The R-Car DU driver treats the pitch passed in from userspace as minimum > and will only overwrite it when the driver-computed pitch is larger, > allowing userspace to, intentionally or not, overallocate framebuffers. > > Signed-off-by: Thierry Reding <treding@xxxxxxxxxx> Reviewed-by: Daniel Vetter <daniel.vetter@xxxxxxxx> Aside: I tend to put the maintainer Cc: into the patch so that they're on the permanent record. That will also make sure that when this patch gets resend (e.g. stable backport) maintainers are still included properly. -Daniel > --- > drivers/gpu/drm/rcar-du/rcar_du_kms.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c > index 5329491e32c3..6289e3797bc5 100644 > --- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c > +++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c > @@ -126,7 +126,7 @@ int rcar_du_dumb_create(struct drm_file *file, struct drm_device *dev, > else > align = 16 * args->bpp / 8; > > - args->pitch = roundup(max(args->pitch, min_pitch), align); > + args->pitch = roundup(min_pitch, align); > > return drm_gem_cma_dumb_create_internal(file, dev, args); > } > -- > 2.1.3 > > _______________________________________________ > dri-devel mailing list > dri-devel@xxxxxxxxxxxxxxxxxxxxx > http://lists.freedesktop.org/mailman/listinfo/dri-devel -- Daniel Vetter Software Engineer, Intel Corporation +41 (0) 79 365 57 48 - http://blog.ffwll.ch _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx http://lists.freedesktop.org/mailman/listinfo/dri-devel
