On Tue, Nov 17, 2015 at 01:04:21PM +0200, Ville Syrjälä wrote:
> On Tue, Nov 17, 2015 at 10:47:06AM +0100, Daniel Vetter wrote:
> > On Wed, Nov 11, 2015 at 07:11:28PM +0200, ville.syrjala@xxxxxxxxxxxxxxx wrote:
> > > From: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
> > >
> > > We try to convert the old way of of specifying fb tiling (obj->tiling)
> > > into the new fb modifiers. We store the result in the passed in mode_cmd
> > > structure. But that structure comes directly from the addfb2 ioctl, and
> > > gets copied back out to userspace, which means we're clobbering the
> > > modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIFIERS
> > > flag wasn't even set by the user). Hence if the user reuses the struct
> > > for another addfb2, the ioctl will be rejected since it's now asking for
> > > some modifiers w/o the flag set.
> > >
> > > Fix the problem by making a copy of the user provided structure. We can
> > > play any games we want with the copy.
> > >
> > > Cc: stable@xxxxxxxxxxxxxxx
> > > Cc: Daniel Vetter <daniel.vetter@xxxxxxxx>
> > > Cc: Tvrtko Ursulin <tvrtko.ursulin@xxxxxxxxx>
> > > Fixes: 2a80eada326f ("drm/i915: Add fb format modifier support")
> > > Testcase: igt/kms_addfb_basic/clobbered-modifier
> > > Signed-off-by: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
> >
> > Out of curiosity: Where does this blow up? That should be added to the
> > commit message (so that people affected can match it up with this fix).
>
> I don't know that it affects any actual users. The way I caught this was
> running kms_addfb_basic. One of the subtests failed when I ran the full
> test, but if I ran only the specific subtest it was fine. So the
> modifiers got clobbered by the previous subtest. I already forgot which
> subtest it was, but it's easy enough to track it down again.
# ./tests/kms_addfb_basic
IGT-Version: 1.12-git (x86_64) (Linux: 4.4.0-rc1-stereo+ x86_64)
...
Subtest basic-X-tiled: SUCCESS (0.001s)
Test assertion failure function pitch_tests, file kms_addfb_basic.c:167:
Failed assertion: drmIoctl(fd, DRM_IOCTL_MODE_ADDFB2, &f) == 0
Last errno: 22, Invalid argument
Stack trace:
#0 [__igt_fail_assert+0x101]
#1 [pitch_tests+0x619]
#2 [__real_main426+0x2f]
#3 [main+0x23]
#4 [__libc_start_main+0xf0]
#5 [_start+0x29]
#6 [<unknown>+0x29]
Subtest framebuffer-vs-set-tiling failed.
**** DEBUG ****
Test assertion failure function pitch_tests, file kms_addfb_basic.c:167:
Failed assertion: drmIoctl(fd, DRM_IOCTL_MODE_ADDFB2, &f) == 0
Last errno: 22, Invalid argument
**** END ****
Subtest framebuffer-vs-set-tiling: FAIL (0.003s)
...
# ./tests/kms_addfb_basic --r framebuffer-vs-set-tiling
IGT-Version: 1.12-git (x86_64) (Linux: 4.4.0-rc1-stereo+ x86_64)
Subtest framebuffer-vs-set-tiling: SUCCESS (0.000s)
>
> > With that:
> >
> > Reviewed-by: Daniel Vetter <daniel.vetter@xxxxxxxx>
> >
> >
> > > ---
> > > drivers/gpu/drm/i915/intel_display.c | 7 ++++---
> > > 1 file changed, 4 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
> > > index b5f7493..c3aa6f5 100644
> > > --- a/drivers/gpu/drm/i915/intel_display.c
> > > +++ b/drivers/gpu/drm/i915/intel_display.c
> > > @@ -14578,17 +14578,18 @@ static int intel_framebuffer_init(struct drm_device *dev,
> > > static struct drm_framebuffer *
> > > intel_user_framebuffer_create(struct drm_device *dev,
> > > struct drm_file *filp,
> > > - struct drm_mode_fb_cmd2 *mode_cmd)
> > > + struct drm_mode_fb_cmd2 *user_mode_cmd)
> > > {
> > > struct drm_framebuffer *fb;
> > > struct drm_i915_gem_object *obj;
> > > + struct drm_mode_fb_cmd2 mode_cmd = *user_mode_cmd;
> > >
> > > obj = to_intel_bo(drm_gem_object_lookup(dev, filp,
> > > - mode_cmd->handles[0]));
> > > + mode_cmd.handles[0]));
> > > if (&obj->base == NULL)
> > > return ERR_PTR(-ENOENT);
> > >
> > > - fb = intel_framebuffer_create(dev, mode_cmd, obj);
> > > + fb = intel_framebuffer_create(dev, &mode_cmd, obj);
> > > if (IS_ERR(fb))
> > > drm_gem_object_unreference_unlocked(&obj->base);
> > >
> > > --
> > > 2.4.10
> > >
> >
> > --
> > Daniel Vetter
> > Software Engineer, Intel Corporation
> > http://blog.ffwll.ch
>
> --
> Ville Syrjälä
> Intel OTC
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx
--
Ville Syrjälä
Intel OTC
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html