[PATCH v5 1/6] drm/damage_helper: Check if damage clips has valid values

Simon Ser contact at emersion.fr
Mon Dec 14 08:55:33 UTC 2020


> Userspace can set a damage clip with a negative coordinate, negative
> width or height or larger than the plane.
> This invalid values could cause issues in some HW or even worst enable
> security flaws.
>
> v2:
> - add debug messages to let userspace know why atomic commit failed
> due invalid damage clips
>
> Cc: Simon Ser <contact at emersion.fr>
> Cc: Gwan-gyeong Mun <gwan-gyeong.mun at intel.com>
> Cc: Sean Paul <seanpaul at chromium.org>
> Cc: Fabio Estevam <festevam at gmail.com>
> Cc: Deepak Rawat <drawat at vmware.com>
> Cc: dri-devel at lists.freedesktop.org
> Signed-off-by: José Roberto de Souza <jose.souza at intel.com>

After looking at the kernel code, it seems like the kernel already checks for
all of that in drm_atomic_plane_check. Are you aware of this?

> +	w = drm_rect_width(&plane_state->src) >> 16;
> +	h = drm_rect_height(&plane_state->src) >> 16;

The docs say this should be in FB coordinates, not in SRC_* coordinates. So we
shouldn't need to check any SRC_* prop here.



More information about the dri-devel mailing list