leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

drm/gem: Ignore color planes that are unused by framebuffer format

Browse Source 
Only handle color planes that exist in a framebuffer's color format.
Ignore non-existing planes.

So far, several helpers assumed that all 4 planes are available and
silently ignored non-existing planes. This lead to subtil bugs with
uninitialized data in instances of struct iosys_map. [1]

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Tested-by: Noralf Trønnes <noralf@tronnes.org>
Acked-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/dri-devel/20210730183511.20080-1-tzimmermann@suse.de/T/#md0172b10bb588d8f20f4f456e304f08d2a4505f7 # 1
Link: https://patchwork.freedesktop.org/patch/msgid/20220517113327.26919-3-tzimmermann@suse.de
This commit is contained in:
Thomas Zimmermann 2022-05-17 13:33:24 +02:00
parent f159b1b22c
commit 746b9c62cc
3 changed files with 27 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/gpu/drm/drm_gem_atomic_helper.c
View File

@ -169,8 +169,10 @@ int drm_gem_plane_helper_prepare_fb(struct drm_plane *plane,
struct drm_gem_object *obj = drm_gem_fb_get_obj(state->fb, i); struct drm_gem_object *obj = drm_gem_fb_get_obj(state->fb, i);
struct dma_fence *new; struct dma_fence *new;
if (WARN_ON_ONCE(!obj)) if (!obj) {
continue; ret = -EINVAL;
goto error;
}
ret = dma_resv_get_singleton(obj->resv, usage, &new); ret = dma_resv_get_singleton(obj->resv, usage, &new);
if (ret) if (ret)

37
drivers/gpu/drm/drm_gem_framebuffer_helper.c
View File

@ -92,9 +92,9 @@ drm_gem_fb_init(struct drm_device *dev,
*/ */
void drm_gem_fb_destroy(struct drm_framebuffer *fb) void drm_gem_fb_destroy(struct drm_framebuffer *fb)
{ {
size_t i; unsigned int i;
for (i = 0; i < ARRAY_SIZE(fb->obj); i++) for (i = 0; i < fb->format->num_planes; i++)
drm_gem_object_put(fb->obj[i]); drm_gem_object_put(fb->obj[i]);
drm_framebuffer_cleanup(fb); drm_framebuffer_cleanup(fb);
@ -329,24 +329,26 @@ EXPORT_SYMBOL_GPL(drm_gem_fb_create_with_dirty);
* The argument returns the addresses of the data stored in each BO. This * The argument returns the addresses of the data stored in each BO. This
* is different from @map if the framebuffer's offsets field is non-zero. * is different from @map if the framebuffer's offsets field is non-zero.
* *
* Both, @map and @data, must each refer to arrays with at least
* fb->format->num_planes elements.
*
* See drm_gem_fb_vunmap() for unmapping. * See drm_gem_fb_vunmap() for unmapping.
* *
* Returns: * Returns:
* 0 on success, or a negative errno code otherwise. * 0 on success, or a negative errno code otherwise.
*/ */
int drm_gem_fb_vmap(struct drm_framebuffer *fb, int drm_gem_fb_vmap(struct drm_framebuffer *fb, struct iosys_map *map,
struct iosys_map map[static DRM_FORMAT_MAX_PLANES], struct iosys_map *data)
struct iosys_map data[DRM_FORMAT_MAX_PLANES])
{ {
struct drm_gem_object *obj; struct drm_gem_object *obj;
unsigned int i; unsigned int i;
int ret; int ret;
for (i = 0; i < DRM_FORMAT_MAX_PLANES; ++i) { for (i = 0; i < fb->format->num_planes; ++i) {
obj = drm_gem_fb_get_obj(fb, i); obj = drm_gem_fb_get_obj(fb, i);
if (!obj) { if (!obj) {
iosys_map_clear(&map[i]); ret = -EINVAL;
continue; goto err_drm_gem_vunmap;
} }
ret = drm_gem_vmap(obj, &map[i]); ret = drm_gem_vmap(obj, &map[i]);
if (ret) if (ret)
@ -354,7 +356,7 @@ int drm_gem_fb_vmap(struct drm_framebuffer *fb,
} }
if (data) { if (data) {
for (i = 0; i < DRM_FORMAT_MAX_PLANES; ++i) { for (i = 0; i < fb->format->num_planes; ++i) {
memcpy(&data[i], &map[i], sizeof(data[i])); memcpy(&data[i], &map[i], sizeof(data[i]));
if (iosys_map_is_null(&data[i])) if (iosys_map_is_null(&data[i]))
continue; continue;
@ -385,10 +387,9 @@ EXPORT_SYMBOL(drm_gem_fb_vmap);
* *
* See drm_gem_fb_vmap() for more information. * See drm_gem_fb_vmap() for more information.
*/ */
void drm_gem_fb_vunmap(struct drm_framebuffer *fb, void drm_gem_fb_vunmap(struct drm_framebuffer *fb, struct iosys_map *map)
struct iosys_map map[static DRM_FORMAT_MAX_PLANES])
{ {
unsigned int i = DRM_FORMAT_MAX_PLANES; unsigned int i = fb->format->num_planes;
struct drm_gem_object *obj; struct drm_gem_object *obj;
while (i) { while (i) {
@ -443,13 +444,15 @@ int drm_gem_fb_begin_cpu_access(struct drm_framebuffer *fb, enum dma_data_direct
{ {
struct dma_buf_attachment *import_attach; struct dma_buf_attachment *import_attach;
struct drm_gem_object *obj; struct drm_gem_object *obj;
size_t i; unsigned int i;
int ret; int ret;
for (i = 0; i < ARRAY_SIZE(fb->obj); ++i) { for (i = 0; i < fb->format->num_planes; ++i) {
obj = drm_gem_fb_get_obj(fb, i); obj = drm_gem_fb_get_obj(fb, i);
if (!obj) if (!obj) {
continue; ret = -EINVAL;
goto err___drm_gem_fb_end_cpu_access;
}
import_attach = obj->import_attach; import_attach = obj->import_attach;
if (!import_attach) if (!import_attach)
continue; continue;
@ -479,7 +482,7 @@ EXPORT_SYMBOL(drm_gem_fb_begin_cpu_access);
*/ */
void drm_gem_fb_end_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir) void drm_gem_fb_end_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir)
{ {
__drm_gem_fb_end_cpu_access(fb, dir, ARRAY_SIZE(fb->obj)); __drm_gem_fb_end_cpu_access(fb, dir, fb->format->num_planes);
} }
EXPORT_SYMBOL(drm_gem_fb_end_cpu_access); EXPORT_SYMBOL(drm_gem_fb_end_cpu_access);

10
include/drm/drm_gem_framebuffer_helper.h
View File

@ -4,8 +4,6 @@
#include <linux/dma-buf.h> #include <linux/dma-buf.h>
#include <linux/iosys-map.h> #include <linux/iosys-map.h>
#include <drm/drm_fourcc.h>
struct drm_afbc_framebuffer; struct drm_afbc_framebuffer;
struct drm_device; struct drm_device;
struct drm_fb_helper_surface_size; struct drm_fb_helper_surface_size;
@ -39,11 +37,9 @@ struct drm_framebuffer *
drm_gem_fb_create_with_dirty(struct drm_device *dev, struct drm_file *file, drm_gem_fb_create_with_dirty(struct drm_device *dev, struct drm_file *file,
const struct drm_mode_fb_cmd2 *mode_cmd); const struct drm_mode_fb_cmd2 *mode_cmd);
int drm_gem_fb_vmap(struct drm_framebuffer *fb, int drm_gem_fb_vmap(struct drm_framebuffer *fb, struct iosys_map *map,
struct iosys_map map[static DRM_FORMAT_MAX_PLANES], struct iosys_map *data);
struct iosys_map data[DRM_FORMAT_MAX_PLANES]); void drm_gem_fb_vunmap(struct drm_framebuffer *fb, struct iosys_map *map);
void drm_gem_fb_vunmap(struct drm_framebuffer *fb,
struct iosys_map map[static DRM_FORMAT_MAX_PLANES]);
int drm_gem_fb_begin_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir); int drm_gem_fb_begin_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir);
void drm_gem_fb_end_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir); void drm_gem_fb_end_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir);