On Tue, Jul 26, 2016 at 12:39 PM, Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx> wrote: > On Tue, Jul 26, 2016 at 05:24:42PM +0100, Chris Wilson wrote: >> On Tue, Jul 26, 2016 at 07:06:56PM +0300, ville.syrjala@xxxxxxxxxxxxxxx wrote: >> > From: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx> >> > >> > Passing negative width/hight to scale factor calculations is not nit: s/hight/height/ >> > legal. Let's WARN if that happens. >> >> Does this get called with user controllable inputs? > > User controllable to a degree. width/height can only ever be positive > though. > I think the only risk is getting UINT_MAX from userspace, since drm_rect stores ints. However, it looks like check_src_coords() and the check in __setplane_internal() should ensure those values are pruned out. Reviewed-by: Sean Paul <seanpaul@xxxxxxxxxxxx> >> A quick grep leads >> me to drm_primary_helper_update() which suggests no. Did I miss a >> potential user controllable WARN->panic? > > I just landed in the BUG_ON in intel_sprite.c on account of a typo I > made in the user src/crtc coordinate -> drm_rect conversion. Should > probably replace the BUG_ON() with WARN_ON() in i915 as well... > > -- > Ville Syrjälä > Intel OTC > _______________________________________________ > Intel-gfx mailing list > Intel-gfx@xxxxxxxxxxxxxxxxxxxxx > https://lists.freedesktop.org/mailman/listinfo/intel-gfx _______________________________________________ Intel-gfx mailing list Intel-gfx@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/intel-gfx
