* [PATCH] drm/fb-helper: add virtual screen size check to drm_fb_helper_check_var()
@ 2022-08-11 10:23 ` Andrey Strachuk
0 siblings, 0 replies; 4+ messages in thread
From: Andrey Strachuk @ 2022-08-11 10:23 UTC (permalink / raw)
To: Maarten Lankhorst
Cc: Andrey Strachuk, Maxime Ripard, Thomas Zimmermann, David Airlie,
Daniel Vetter, Geert Uytterhoeven, Helge Deller, dri-devel,
linux-kernel, ldv-project
Add virtual screen size check to drm_fb_helper_check_var() in
order to validate userspace input.
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
Signed-off-by: Andrey Strachuk <strochuk@ispras.ru>
Fixes: 6c11df58fd1a ("fbmem: Check virtual screen sizes in fb_set_var()")
---
drivers/gpu/drm/drm_fb_helper.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 2d4cee6a10ff..d21fe89358af 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1355,6 +1355,16 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
(drm_format_info_block_height(fb->format, 0) > 1))
return -EINVAL;
+ /* verify that virtual resolution >= physical resolution */
+ if (var->xres_virtual < var->xres ||
+ var->yres_virtual < var->yres) {
+ drm_dbg_kms(dev, "requested virtual screen size that is "
+ "below the physical size(%ux%u vs. %ux%u)\n",
+ var->xres_virtual, var->yres_virtual,
+ var->xres, var->yres);
+ return -EINVAL;
+ }
+
/*
* Changes struct fb_var_screeninfo are currently not pushed back
* to KMS, hence fail if different settings are requested.
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH] drm/fb-helper: add virtual screen size check to drm_fb_helper_check_var()
@ 2022-08-11 10:23 ` Andrey Strachuk
0 siblings, 0 replies; 4+ messages in thread
From: Andrey Strachuk @ 2022-08-11 10:23 UTC (permalink / raw)
To: Maarten Lankhorst
Cc: ldv-project, Andrey Strachuk, Thomas Zimmermann, David Airlie,
Helge Deller, linux-kernel, Geert Uytterhoeven, dri-devel
Add virtual screen size check to drm_fb_helper_check_var() in
order to validate userspace input.
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
Signed-off-by: Andrey Strachuk <strochuk@ispras.ru>
Fixes: 6c11df58fd1a ("fbmem: Check virtual screen sizes in fb_set_var()")
---
drivers/gpu/drm/drm_fb_helper.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 2d4cee6a10ff..d21fe89358af 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1355,6 +1355,16 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
(drm_format_info_block_height(fb->format, 0) > 1))
return -EINVAL;
+ /* verify that virtual resolution >= physical resolution */
+ if (var->xres_virtual < var->xres ||
+ var->yres_virtual < var->yres) {
+ drm_dbg_kms(dev, "requested virtual screen size that is "
+ "below the physical size(%ux%u vs. %ux%u)\n",
+ var->xres_virtual, var->yres_virtual,
+ var->xres, var->yres);
+ return -EINVAL;
+ }
+
/*
* Changes struct fb_var_screeninfo are currently not pushed back
* to KMS, hence fail if different settings are requested.
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] drm/fb-helper: add virtual screen size check to drm_fb_helper_check_var()
2022-08-11 10:23 ` Andrey Strachuk
@ 2022-08-11 11:49 ` Geert Uytterhoeven
-1 siblings, 0 replies; 4+ messages in thread
From: Geert Uytterhoeven @ 2022-08-11 11:49 UTC (permalink / raw)
To: Andrey Strachuk
Cc: Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Daniel Vetter, Helge Deller, DRI Development,
Linux Kernel Mailing List, ldv-project
Hi Andrey,
On Thu, Aug 11, 2022 at 12:23 PM Andrey Strachuk <strochuk@ispras.ru> wrote:
> Add virtual screen size check to drm_fb_helper_check_var() in
> order to validate userspace input.
>
> Found by Linux Verification Center (linuxtesting.org) with syzkaller.
>
> Signed-off-by: Andrey Strachuk <strochuk@ispras.ru>
Thanks for your patch!
> Fixes: 6c11df58fd1a ("fbmem: Check virtual screen sizes in fb_set_var()")
This Fixes tag is misleading: the bug has existed since basically
forever.
> --- a/drivers/gpu/drm/drm_fb_helper.c
> +++ b/drivers/gpu/drm/drm_fb_helper.c
> @@ -1355,6 +1355,16 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
> (drm_format_info_block_height(fb->format, 0) > 1))
> return -EINVAL;
>
> + /* verify that virtual resolution >= physical resolution */
> + if (var->xres_virtual < var->xres ||
> + var->yres_virtual < var->yres) {
> + drm_dbg_kms(dev, "requested virtual screen size that is "
> + "below the physical size(%ux%u vs. %ux%u)\n",
> + var->xres_virtual, var->yres_virtual,
> + var->xres, var->yres);
> + return -EINVAL;
According to the fbdev rounding rules, invalid values should be rounded
up, if possible. Hence it is better to not return an error, but round up:
if (var->xres_virtual < var->xres)
var->xres_virtual = var->xres;
if (var->yres_virtual < var->yres)
var->yres_virtual = var->yres;
> + }
> +
> /*
> * Changes struct fb_var_screeninfo are currently not pushed back
> * to KMS, hence fail if different settings are requested.
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] drm/fb-helper: add virtual screen size check to drm_fb_helper_check_var()
@ 2022-08-11 11:49 ` Geert Uytterhoeven
0 siblings, 0 replies; 4+ messages in thread
From: Geert Uytterhoeven @ 2022-08-11 11:49 UTC (permalink / raw)
To: Andrey Strachuk
Cc: ldv-project, Thomas Zimmermann, David Airlie, Helge Deller,
Linux Kernel Mailing List, DRI Development
Hi Andrey,
On Thu, Aug 11, 2022 at 12:23 PM Andrey Strachuk <strochuk@ispras.ru> wrote:
> Add virtual screen size check to drm_fb_helper_check_var() in
> order to validate userspace input.
>
> Found by Linux Verification Center (linuxtesting.org) with syzkaller.
>
> Signed-off-by: Andrey Strachuk <strochuk@ispras.ru>
Thanks for your patch!
> Fixes: 6c11df58fd1a ("fbmem: Check virtual screen sizes in fb_set_var()")
This Fixes tag is misleading: the bug has existed since basically
forever.
> --- a/drivers/gpu/drm/drm_fb_helper.c
> +++ b/drivers/gpu/drm/drm_fb_helper.c
> @@ -1355,6 +1355,16 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
> (drm_format_info_block_height(fb->format, 0) > 1))
> return -EINVAL;
>
> + /* verify that virtual resolution >= physical resolution */
> + if (var->xres_virtual < var->xres ||
> + var->yres_virtual < var->yres) {
> + drm_dbg_kms(dev, "requested virtual screen size that is "
> + "below the physical size(%ux%u vs. %ux%u)\n",
> + var->xres_virtual, var->yres_virtual,
> + var->xres, var->yres);
> + return -EINVAL;
According to the fbdev rounding rules, invalid values should be rounded
up, if possible. Hence it is better to not return an error, but round up:
if (var->xres_virtual < var->xres)
var->xres_virtual = var->xres;
if (var->yres_virtual < var->yres)
var->yres_virtual = var->yres;
> + }
> +
> /*
> * Changes struct fb_var_screeninfo are currently not pushed back
> * to KMS, hence fail if different settings are requested.
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-08-11 14:00 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-08-11 10:23 [PATCH] drm/fb-helper: add virtual screen size check to drm_fb_helper_check_var() Andrey Strachuk
2022-08-11 10:23 ` Andrey Strachuk
2022-08-11 11:49 ` Geert Uytterhoeven
2022-08-11 11:49 ` Geert Uytterhoeven
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.