[GIT PULL] drm: Sanitize DRM_IOCTL_MODE_CREATE_DUMB input

[Thierry Reding]

Hi Dave,

The following changes since commit f114040e3ea6e07372334ade75d1ee0775c355e1:

  Linux 3.18-rc1 (2014-10-19 18:08:38 -0700)

are available in the git repository at:

  git://people.freedesktop.org/~tagr/linux tags/drm/gem-cma/for-3.19-rc1

for you to fetch changes up to 7ff7f0a1a934d0d073560dcabe7508e0a4f75f1c:

  drm/cma: Remove call to drm_gem_free_mmap_offset() (2014-11-13 13:27:33 +0100)

Thanks,
Thierry

----------------------------------------------------------------
drm: Sanitize DRM_IOCTL_MODE_CREATE_DUMB input

Some drivers erroneously treat the .pitch and .size fields of struct
drm_mode_create_dumb as inputs. While the include/uapi/drm/drm_mode.h
header has a comment denoting them as outputs, that seemingly wasn't
enough to make drivers use them properly.

The result is that some userspace doesn't explicitly zero out those
fields, assuming that the kernel won't use them. That causes problems
since the data within the structure might be uninitialized, so bogus
data may end up confusing drivers (ridiculously large values for the
pitch, ...).

This series attempts to improve the situation by fixing all drivers to
not use the output fields. Furthermore to spare new drivers this bad
surprise, the DRM core now zeros out these fields prior to handing the
data structure to the driver.

Lessons learned from this are that future IOCTLs should be properly
documented (in the DRM DocBook for example) and should be rigorously
defined. To prevent misuse like this, userspace should be required to
zero out all output fields. The kernel should check for this and fail
if that's not the case.

----------------------------------------------------------------
Thierry Reding (8):
      drm/gem: Fix a few kerneldoc typos
      drm/doc: mm: Fix indentation
      drm/doc: Add GEM/CMA helpers to kerneldoc
      drm/cma: Introduce drm_gem_cma_dumb_create_internal()
      drm/omap: gem: dumb: pitch is an output
      drm/rcar: gem: dumb: pitch is an output
      drm: Sanitize DRM_IOCTL_MODE_CREATE_DUMB input
      drm/cma: Remove call to drm_gem_free_mmap_offset()

 Documentation/DocBook/drm.tmpl        | 274 +++++++++++++++++-----------------
 drivers/gpu/drm/drm_crtc.c            |  10 ++
 drivers/gpu/drm/drm_gem.c             |  11 +-
 drivers/gpu/drm/drm_gem_cma_helper.c  | 259 ++++++++++++++++++++++++++------
 drivers/gpu/drm/omapdrm/omap_gem.c    |   3 +-
 drivers/gpu/drm/rcar-du/rcar_du_kms.c |   4 +-
 include/drm/drm_gem_cma_helper.h      |  30 +++-
 7 files changed, 395 insertions(+), 196 deletions(-)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20141113/48eb908d/attachment.sig>