mirror of
https://github.com/torvalds/linux.git
synced 2024-12-11 05:33:09 +00:00
ca5a71de48
Some drivers erroneously treat the .pitch and .size fields of struct drm_mode_create_dumb as inputs. While the include/uapi/drm/drm_mode.h header has a comment denoting them as outputs, that seemingly wasn't enough to make drivers use them properly. The result is that some userspace doesn't explicitly zero out those fields, assuming that the kernel won't use them. That causes problems since the data within the structure might be uninitialized, so bogus data may end up confusing drivers (ridiculously large values for the pitch, ...). This series attempts to improve the situation by fixing all drivers to not use the output fields. Furthermore to spare new drivers this bad surprise, the DRM core now zeros out these fields prior to handing the data structure to the driver. Lessons learned from this are that future IOCTLs should be properly documented (in the DRM DocBook for example) and should be rigorously defined. To prevent misuse like this, userspace should be required to zero out all output fields. The kernel should check for this and fail if that's not the case. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAABAgAGBQJUZKbcAAoJEN0jrNd/PrOh57QQAKdX7ASd4XVhMC6fuVGXHUXI HVZuJ3Own+e3aAJKhZ2DZ263+PtBLfe3+eEF1WRWqZcDu647Nj3wSV64celdZdIl WHU2RokxneHTPHlttZ+MLhVwtzSddO8712iLU/2B7Rg/MNlN9tv9tbRtGqPWwlzg IZNAdU5etnm+YDYil8/I8f84+5vT59Z/X2NHbq+jReD3V6I2WBAK6zlRIy4o54io fccK7M6+uGlbNmtPwoKXufeiqTxxdYYelZoQzO4NjWEhdU0LoUnTFdfqISSdt3HV 26NwTmqVTx38AD5bGwot2b1VFEkja5tkP7G+DeFkj0DRHbFfAQK/tNeqdf9xq4gQ UEVjljyEW6dauibtT6ASk2RoTmQmMVWw44aSulcaz6eVqa21zpEwOZVMX/VW3QM+ vKh4Vy6eVbCHmdOiXgtQSexQAN6uO1o9cHEGamJQpMshm+kax9T7hBdcHMH0ORtL uEYHXzqB/bbkhAodHTraoZ5aM8YFwS2TgGtCJoYw1GHehMhjpJG9HaDlL50lkObk LDUShta8AwN9iu3/qmkaYaxkbBPEnRtU9d9qO6S1NsZugBmmEUj6lNKFOK13U9Ho vjKWTpB4USgKdrTwJXEAXJTBmubwrPBnZb1vdCovCtC3JS7sXUH8AM/E6tp4Q0Go idGCjMglaSFO8EUeScFT =QZIW -----END PGP SIGNATURE----- Merge tag 'drm/gem-cma/for-3.19-rc1' of git://people.freedesktop.org/~tagr/linux into drm-next drm: Sanitize DRM_IOCTL_MODE_CREATE_DUMB input Some drivers erroneously treat the .pitch and .size fields of struct drm_mode_create_dumb as inputs. While the include/uapi/drm/drm_mode.h header has a comment denoting them as outputs, that seemingly wasn't enough to make drivers use them properly. The result is that some userspace doesn't explicitly zero out those fields, assuming that the kernel won't use them. That causes problems since the data within the structure might be uninitialized, so bogus data may end up confusing drivers (ridiculously large values for the pitch, ...). This series attempts to improve the situation by fixing all drivers to not use the output fields. Furthermore to spare new drivers this bad surprise, the DRM core now zeros out these fields prior to handing the data structure to the driver. Lessons learned from this are that future IOCTLs should be properly documented (in the DRM DocBook for example) and should be rigorously defined. To prevent misuse like this, userspace should be required to zero out all output fields. The kernel should check for this and fail if that's not the case. * tag 'drm/gem-cma/for-3.19-rc1' of git://people.freedesktop.org/~tagr/linux: drm/cma: Remove call to drm_gem_free_mmap_offset() drm: Sanitize DRM_IOCTL_MODE_CREATE_DUMB input drm/rcar: gem: dumb: pitch is an output drm/omap: gem: dumb: pitch is an output drm/cma: Introduce drm_gem_cma_dumb_create_internal() drm/doc: Add GEM/CMA helpers to kerneldoc drm/doc: mm: Fix indentation drm/gem: Fix a few kerneldoc typos |
||
|---|---|---|
| .. | ||
| ABI | ||
| accounting | ||
| acpi | ||
| aoe | ||
| arm | ||
| arm64 | ||
| auxdisplay | ||
| backlight | ||
| blackfin | ||
| block | ||
| blockdev | ||
| bus-devices | ||
| cdrom | ||
| cgroups | ||
| connector | ||
| console | ||
| cpu-freq | ||
| cpuidle | ||
| cris | ||
| crypto | ||
| development-process | ||
| device-mapper | ||
| devicetree | ||
| DocBook | ||
| driver-model | ||
| dvb | ||
| early-userspace | ||
| EDID | ||
| extcon | ||
| fault-injection | ||
| fb | ||
| filesystems | ||
| firmware_class | ||
| fmc | ||
| frv | ||
| gpio | ||
| hid | ||
| hwmon | ||
| i2c | ||
| i2o | ||
| ia64 | ||
| ide | ||
| infiniband | ||
| input | ||
| ioctl | ||
| isdn | ||
| ja_JP | ||
| kbuild | ||
| kdump | ||
| ko_KR | ||
| laptops | ||
| leds | ||
| locking | ||
| m68k | ||
| memory-devices | ||
| metag | ||
| mic | ||
| mips | ||
| misc-devices | ||
| mmc | ||
| mn10300 | ||
| mtd | ||
| namespaces | ||
| netlabel | ||
| networking | ||
| nfc | ||
| parisc | ||
| PCI | ||
| pcmcia | ||
| phy | ||
| platform | ||
| power | ||
| powerpc | ||
| pps | ||
| prctl | ||
| pti | ||
| ptp | ||
| rapidio | ||
| RCU | ||
| s390 | ||
| scheduler | ||
| scsi | ||
| security | ||
| serial | ||
| sh | ||
| sound | ||
| spi | ||
| sysctl | ||
| target | ||
| thermal | ||
| timers | ||
| tpm | ||
| trace | ||
| usb | ||
| vDSO | ||
| video4linux | ||
| virtual | ||
| vm | ||
| w1 | ||
| watchdog | ||
| wimax | ||
| x86 | ||
| xtensa | ||
| zh_CN | ||
| 00-INDEX | ||
| applying-patches.txt | ||
| assoc_array.txt | ||
| atomic_ops.txt | ||
| bad_memory.txt | ||
| basic_profiling.txt | ||
| bcache.txt | ||
| binfmt_misc.txt | ||
| braille-console.txt | ||
| bt8xxgpio.txt | ||
| btmrvl.txt | ||
| BUG-HUNTING | ||
| bus-virt-phys-mapping.txt | ||
| cachetlb.txt | ||
| Changes | ||
| circular-buffers.txt | ||
| clk.txt | ||
| coccinelle.txt | ||
| CodingStyle | ||
| cpu-hotplug.txt | ||
| cpu-load.txt | ||
| cputopology.txt | ||
| crc32.txt | ||
| dcdbas.txt | ||
| debugging-modules.txt | ||
| debugging-via-ohci1394.txt | ||
| dell_rbu.txt | ||
| devices.txt | ||
| digsig.txt | ||
| DMA-API-HOWTO.txt | ||
| DMA-API.txt | ||
| DMA-attributes.txt | ||
| dma-buf-sharing.txt | ||
| DMA-ISA-LPC.txt | ||
| dmaengine.txt | ||
| dmatest.txt | ||
| dontdiff | ||
| dynamic-debug-howto.txt | ||
| edac.txt | ||
| efi-stub.txt | ||
| eisa.txt | ||
| email-clients.txt | ||
| flexible-arrays.txt | ||
| futex-requeue-pi.txt | ||
| gcov.txt | ||
| highuid.txt | ||
| HOWTO | ||
| hsi.txt | ||
| hw_random.txt | ||
| hwspinlock.txt | ||
| init.txt | ||
| initrd.txt | ||
| intel_txt.txt | ||
| Intel-IOMMU.txt | ||
| io_ordering.txt | ||
| io-mapping.txt | ||
| iostats.txt | ||
| IPMI.txt | ||
| IRQ-affinity.txt | ||
| IRQ-domain.txt | ||
| IRQ.txt | ||
| irqflags-tracing.txt | ||
| isapnp.txt | ||
| java.txt | ||
| kernel-doc-nano-HOWTO.txt | ||
| kernel-docs.txt | ||
| kernel-parameters.txt | ||
| kernel-per-CPU-kthreads.txt | ||
| kmemcheck.txt | ||
| kmemleak.txt | ||
| kobject.txt | ||
| kprobes.txt | ||
| kref.txt | ||
| ldm.txt | ||
| local_ops.txt | ||
| lockup-watchdogs.txt | ||
| logo.gif | ||
| logo.txt | ||
| lzo.txt | ||
| magic-number.txt | ||
| mailbox.txt | ||
| Makefile | ||
| ManagementStyle | ||
| md.txt | ||
| media-framework.txt | ||
| memory-barriers.txt | ||
| memory-hotplug.txt | ||
| module-signing.txt | ||
| mono.txt | ||
| nommu-mmap.txt | ||
| numastat.txt | ||
| oops-tracing.txt | ||
| padata.txt | ||
| parport-lowlevel.txt | ||
| parport.txt | ||
| percpu-rw-semaphore.txt | ||
| phy.txt | ||
| pi-futex.txt | ||
| pinctrl.txt | ||
| pnp.txt | ||
| preempt-locking.txt | ||
| printk-formats.txt | ||
| pwm.txt | ||
| ramoops.txt | ||
| rbtree.txt | ||
| remoteproc.txt | ||
| rfkill.txt | ||
| robust-futex-ABI.txt | ||
| robust-futexes.txt | ||
| rpmsg.txt | ||
| rtc.txt | ||
| SAK.txt | ||
| SecurityBugs | ||
| serial-console.txt | ||
| sgi-ioc4.txt | ||
| SM501.txt | ||
| smsc_ece1099.txt | ||
| sparse.txt | ||
| stable_api_nonsense.txt | ||
| stable_kernel_rules.txt | ||
| static-keys.txt | ||
| SubmitChecklist | ||
| SubmittingDrivers | ||
| SubmittingPatches | ||
| svga.txt | ||
| sysfs-rules.txt | ||
| sysrq.txt | ||
| this_cpu_ops.txt | ||
| unaligned-memory-access.txt | ||
| unicode.txt | ||
| unshare.txt | ||
| vfio.txt | ||
| VGA-softcursor.txt | ||
| vgaarbiter.txt | ||
| video-output.txt | ||
| vme_api.txt | ||
| volatile-considered-harmful.txt | ||
| workqueue.txt | ||
| xillybus.txt | ||
| xz.txt | ||
| zorro.txt | ||
