On Wed, Nov 11, 2015 at 07:11:28PM +0200, ville.syrjala@xxxxxxxxxxxxxxx wrote:
> From: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
>
> We try to convert the old way of of specifying fb tiling (obj->tiling)
> into the new fb modifiers. We store the result in the passed in mode_cmd
> structure. But that structure comes directly from the addfb2 ioctl, and
> gets copied back out to userspace, which means we're clobbering the
> modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIFIERS
> flag wasn't even set by the user). Hence if the user reuses the struct
> for another addfb2, the ioctl will be rejected since it's now asking for
> some modifiers w/o the flag set.
>
> Fix the problem by making a copy of the user provided structure. We can
> play any games we want with the copy.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Cc: Daniel Vetter <daniel.vetter@xxxxxxxx>
> Cc: Tvrtko Ursulin <tvrtko.ursulin@xxxxxxxxx>
> Fixes: 2a80eada326f ("drm/i915: Add fb format modifier support")
> Testcase: igt/kms_addfb_basic/clobbered-modifier
> Signed-off-by: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
Out of curiosity: Where does this blow up? That should be added to the
commit message (so that people affected can match it up with this fix).
With that:
Reviewed-by: Daniel Vetter <daniel.vetter@xxxxxxxx>
> ---
> drivers/gpu/drm/i915/intel_display.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
> index b5f7493..c3aa6f5 100644
> --- a/drivers/gpu/drm/i915/intel_display.c
> +++ b/drivers/gpu/drm/i915/intel_display.c
> @@ -14578,17 +14578,18 @@ static int intel_framebuffer_init(struct drm_device *dev,
> static struct drm_framebuffer *
> intel_user_framebuffer_create(struct drm_device *dev,
> struct drm_file *filp,
> - struct drm_mode_fb_cmd2 *mode_cmd)
> + struct drm_mode_fb_cmd2 *user_mode_cmd)
> {
> struct drm_framebuffer *fb;
> struct drm_i915_gem_object *obj;
> + struct drm_mode_fb_cmd2 mode_cmd = *user_mode_cmd;
>
> obj = to_intel_bo(drm_gem_object_lookup(dev, filp,
> - mode_cmd->handles[0]));
> + mode_cmd.handles[0]));
> if (&obj->base == NULL)
> return ERR_PTR(-ENOENT);
>
> - fb = intel_framebuffer_create(dev, mode_cmd, obj);
> + fb = intel_framebuffer_create(dev, &mode_cmd, obj);
> if (IS_ERR(fb))
> drm_gem_object_unreference_unlocked(&obj->base);
>
> --
> 2.4.10
>
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/intel-gfx
