Skip to content

L
linux
Commit e7e44570 authored by Dave Airlie's avatar Dave Airlie
Browse files
Options

drm: in-correct locking in intel drms 

The locking in the intel drms is incorrect it doesn't check
the current context owns the lock, just that someone does.
This could allow strange things to happen with multiple clients.

From: Stefan Dirsch <sndirsch@suse.de>
Approved-by: default avatarDave Airlie <airlied@linux.ie>
parent 9b10c19b
Hide whitespace changes
Inline Side-by-side
Showing with 23 additions and 85 deletions
drivers/char/drm/i810_dma.c
View file @ e7e44570
......@@ -1029,10 +1029,7 @@ int i810_flush_ioctl(struct inode *inode, struct file *filp,
drm_file_t *priv = filp->private_data;
drm_device_t *dev = priv->dev;
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i810_flush_ioctl called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
i810_flush_queue(dev);
return 0;
......@@ -1054,10 +1051,7 @@ int i810_dma_vertex(struct inode *inode, struct file *filp,
if (copy_from_user(&vertex, (drm_i810_vertex_t __user *)arg, sizeof(vertex)))
return -EFAULT;
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i810_dma_vertex called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
DRM_DEBUG("i810 dma vertex, idx %d used %d discard %d\n",
vertex.idx, vertex.used, vertex.discard);
......@@ -1089,10 +1083,7 @@ int i810_clear_bufs(struct inode *inode, struct file *filp,
if (copy_from_user(&clear, (drm_i810_clear_t __user *)arg, sizeof(clear)))
return -EFAULT;
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i810_clear_bufs called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
/* GH: Someone's doing nasty things... */
if (!dev->dev_private) {
......@@ -1113,10 +1104,7 @@ int i810_swap_bufs(struct inode *inode, struct file *filp,
DRM_DEBUG("i810_swap_bufs\n");
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i810_swap_buf called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
i810_dma_dispatch_swap( dev );
return 0;
......@@ -1151,10 +1139,7 @@ int i810_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
if (copy_from_user(&d, (drm_i810_dma_t __user *)arg, sizeof(d)))
return -EFAULT;
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i810_dma called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
d.granted = 0;
......@@ -1264,11 +1249,7 @@ int i810_dma_mc(struct inode *inode, struct file *filp,
if (copy_from_user(&mc, (drm_i810_mc_t __user *)arg, sizeof(mc)))
return -EFAULT;
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i810_dma_mc called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
if (mc.idx >= dma->buf_count || mc.idx < 0)
return -EINVAL;
......@@ -1316,10 +1297,8 @@ int i810_fstatus(struct inode *inode, struct file *filp,
drm_device_t *dev = priv->dev;
drm_i810_private_t *dev_priv = (drm_i810_private_t *)dev->dev_private;
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i810_fstatus called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
return I810_READ(0x30008);
}
......@@ -1330,10 +1309,7 @@ int i810_ov0_flip(struct inode *inode, struct file *filp,
drm_device_t *dev = priv->dev;
drm_i810_private_t *dev_priv = (drm_i810_private_t *)dev->dev_private;
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i810_ov0_flip called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
//Tell the overlay to update
I810_WRITE(0x30000,dev_priv->overlay_physical | 0x80000000);
......@@ -1375,10 +1351,7 @@ int i810_flip_bufs(struct inode *inode, struct file *filp,
DRM_DEBUG("%s\n", __FUNCTION__);
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i810_flip_buf called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
if (!dev_priv->page_flipping)
i810_do_init_pageflip( dev );
......
drivers/char/drm/i830_dma.c
View file @ e7e44570
......@@ -1318,10 +1318,7 @@ int i830_flush_ioctl(struct inode *inode, struct file *filp,
drm_file_t *priv = filp->private_data;
drm_device_t *dev = priv->dev;
if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i830_flush_ioctl called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
i830_flush_queue(dev);
return 0;
......@@ -1342,10 +1339,7 @@ int i830_dma_vertex(struct inode *inode, struct file *filp,
if (copy_from_user(&vertex, (drm_i830_vertex_t __user *)arg, sizeof(vertex)))
return -EFAULT;
if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i830_dma_vertex called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
DRM_DEBUG("i830 dma vertex, idx %d used %d discard %d\n",
vertex.idx, vertex.used, vertex.discard);
......@@ -1372,10 +1366,7 @@ int i830_clear_bufs(struct inode *inode, struct file *filp,
if (copy_from_user(&clear, (drm_i830_clear_t __user *)arg, sizeof(clear)))
return -EFAULT;
if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i830_clear_bufs called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
/* GH: Someone's doing nasty things... */
if (!dev->dev_private) {
......@@ -1397,10 +1388,7 @@ int i830_swap_bufs(struct inode *inode, struct file *filp,
DRM_DEBUG("i830_swap_bufs\n");
if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i830_swap_buf called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
i830_dma_dispatch_swap( dev );
return 0;
......@@ -1441,10 +1429,7 @@ int i830_flip_bufs(struct inode *inode, struct file *filp,
DRM_DEBUG("%s\n", __FUNCTION__);
if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i830_flip_buf called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
if (!dev_priv->page_flipping)
i830_do_init_pageflip( dev );
......@@ -1483,10 +1468,7 @@ int i830_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
if (copy_from_user(&d, (drm_i830_dma_t __user *)arg, sizeof(d)))
return -EFAULT;
if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i830_dma called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
d.granted = 0;
......
drivers/char/drm/i830_irq.c
View file @ e7e44570
......@@ -128,10 +128,7 @@ int i830_irq_emit( struct inode *inode, struct file *filp, unsigned int cmd,
drm_i830_irq_emit_t emit;
int result;
if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i830_irq_emit called without lock held\n");
return -EINVAL;
}
LOCK_TEST_WITH_RETURN(dev, filp);
if ( !dev_priv ) {
DRM_ERROR( "%s called with no initialization\n", __FUNCTION__ );
......
drivers/char/drm/i915_dma.c
View file @ e7e44570
......@@ -544,10 +544,7 @@ int i915_flush_ioctl(DRM_IOCTL_ARGS)
{
DRM_DEVICE;
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i915_flush_ioctl called without lock held\n");
return DRM_ERR(EINVAL);
}
LOCK_TEST_WITH_RETURN(dev, filp);
return i915_quiescent(dev);
}
......@@ -573,10 +570,7 @@ int i915_batchbuffer(DRM_IOCTL_ARGS)
DRM_DEBUG("i915 batchbuffer, start %x used %d cliprects %d\n",
batch.start, batch.used, batch.num_cliprects);
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i915_batchbuffer called without lock held\n");
return DRM_ERR(EINVAL);
}
LOCK_TEST_WITH_RETURN(dev, filp);
if (batch.num_cliprects && DRM_VERIFYAREA_READ(batch.cliprects,
batch.num_cliprects *
......@@ -605,10 +599,7 @@ int i915_cmdbuffer(DRM_IOCTL_ARGS)
DRM_DEBUG("i915 cmdbuffer, buf %p sz %d cliprects %d\n",
cmdbuf.buf, cmdbuf.sz, cmdbuf.num_cliprects);
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i915_cmdbuffer called without lock held\n");
return DRM_ERR(EINVAL);
}
LOCK_TEST_WITH_RETURN(dev, filp);
if (cmdbuf.num_cliprects &&
DRM_VERIFYAREA_READ(cmdbuf.cliprects,
......@@ -644,10 +635,8 @@ int i915_flip_bufs(DRM_IOCTL_ARGS)
DRM_DEVICE;
DRM_DEBUG("%s\n", __FUNCTION__);
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i915_flip_buf called without lock held\n");
return DRM_ERR(EINVAL);
}
LOCK_TEST_WITH_RETURN(dev, filp);
return i915_dispatch_flip(dev);
}
......
drivers/char/drm/i915_irq.c
View file @ e7e44570
......@@ -91,10 +91,7 @@ int i915_irq_emit(DRM_IOCTL_ARGS)
drm_i915_irq_emit_t emit;
int result;
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i915_irq_emit called without lock held\n");
return DRM_ERR(EINVAL);
}
LOCK_TEST_WITH_RETURN(dev, filp);
if (!dev_priv) {
DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7