From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Dave Airlie <airlied@redhat.com>
Subject: [52/63] drm: check for modesetting on modeset ioctls
Date: Fri, 25 Mar 2011 16:44:28 -0700 [thread overview]
Message-ID: <20110325234513.310545074@clark.kroah.org> (raw)
In-Reply-To: <20110325234526.GA18017@kroah.com>
2.6.38-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dave Airlie <airlied@redhat.com>
commit fb3b06c8a1fd1a80298f13b738ab38ef8c73baff upstream.
Noticed this while working on some other things, helps if we check for modeset
enabled on modesetting ioctls.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/gpu/drm/drm_crtc.c | 51 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 51 insertions(+)
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1073,6 +1073,9 @@ int drm_mode_getresources(struct drm_dev
uint32_t __user *encoder_id;
struct drm_mode_group *mode_group;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
/*
@@ -1244,6 +1247,9 @@ int drm_mode_getcrtc(struct drm_device *
struct drm_mode_object *obj;
int ret = 0;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, crtc_resp->crtc_id,
@@ -1312,6 +1318,9 @@ int drm_mode_getconnector(struct drm_dev
uint64_t __user *prop_values;
uint32_t __user *encoder_ptr;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
memset(&u_mode, 0, sizeof(struct drm_mode_modeinfo));
DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
@@ -1431,6 +1440,9 @@ int drm_mode_getencoder(struct drm_devic
struct drm_encoder *encoder;
int ret = 0;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, enc_resp->encoder_id,
DRM_MODE_OBJECT_ENCODER);
@@ -1486,6 +1498,9 @@ int drm_mode_setcrtc(struct drm_device *
int ret = 0;
int i;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, crtc_req->crtc_id,
DRM_MODE_OBJECT_CRTC);
@@ -1603,6 +1618,9 @@ int drm_mode_cursor_ioctl(struct drm_dev
struct drm_crtc *crtc;
int ret = 0;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
if (!req->flags) {
DRM_ERROR("no operation set\n");
return -EINVAL;
@@ -1667,6 +1685,9 @@ int drm_mode_addfb(struct drm_device *de
struct drm_framebuffer *fb;
int ret = 0;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
if ((config->min_width > r->width) || (r->width > config->max_width)) {
DRM_ERROR("mode new framebuffer width not within limits\n");
return -EINVAL;
@@ -1724,6 +1745,9 @@ int drm_mode_rmfb(struct drm_device *dev
int ret = 0;
int found = 0;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, *id, DRM_MODE_OBJECT_FB);
/* TODO check that we realy get a framebuffer back. */
@@ -1780,6 +1804,9 @@ int drm_mode_getfb(struct drm_device *de
struct drm_framebuffer *fb;
int ret = 0;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, r->fb_id, DRM_MODE_OBJECT_FB);
if (!obj) {
@@ -1813,6 +1840,9 @@ int drm_mode_dirtyfb_ioctl(struct drm_de
int num_clips;
int ret = 0;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, r->fb_id, DRM_MODE_OBJECT_FB);
if (!obj) {
@@ -1996,6 +2026,9 @@ int drm_mode_attachmode_ioctl(struct drm
struct drm_mode_modeinfo *umode = &mode_cmd->mode;
int ret = 0;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, mode_cmd->connector_id, DRM_MODE_OBJECT_CONNECTOR);
@@ -2042,6 +2075,9 @@ int drm_mode_detachmode_ioctl(struct drm
struct drm_mode_modeinfo *umode = &mode_cmd->mode;
int ret = 0;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, mode_cmd->connector_id, DRM_MODE_OBJECT_CONNECTOR);
@@ -2211,6 +2247,9 @@ int drm_mode_getproperty_ioctl(struct dr
uint64_t __user *values_ptr;
uint32_t __user *blob_length_ptr;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, out_resp->prop_id, DRM_MODE_OBJECT_PROPERTY);
if (!obj) {
@@ -2333,6 +2372,9 @@ int drm_mode_getblob_ioctl(struct drm_de
int ret = 0;
void *blob_ptr;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, out_resp->blob_id, DRM_MODE_OBJECT_BLOB);
if (!obj) {
@@ -2393,6 +2435,9 @@ int drm_mode_connector_property_set_ioct
int ret = -EINVAL;
int i;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, out_resp->connector_id, DRM_MODE_OBJECT_CONNECTOR);
@@ -2509,6 +2554,9 @@ int drm_mode_gamma_set_ioctl(struct drm_
int size;
int ret = 0;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, crtc_lut->crtc_id, DRM_MODE_OBJECT_CRTC);
if (!obj) {
@@ -2560,6 +2608,9 @@ int drm_mode_gamma_get_ioctl(struct drm_
int size;
int ret = 0;
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, crtc_lut->crtc_id, DRM_MODE_OBJECT_CRTC);
if (!obj) {
next prev parent reply other threads:[~2011-03-26 0:03 UTC|newest]
Thread overview: 64+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-03-25 23:45 [00/63] 2.6.38.2-stable review Greg KH
2011-03-25 23:43 ` [01/63] ALSA: HDA: Realtek: Avoid unnecessary volume control index on Surround/Side Greg KH
2011-03-25 23:43 ` [02/63] ALSA: hda - VIA: Fix stereo mixer recording no sound issue Greg KH
2011-03-25 23:43 ` [03/63] ALSA: hda - VIA: Fix independent headphone " Greg KH
2011-03-25 23:43 ` [04/63] ALSA: hda - VIA: Add missing support for VT1718S in A-A path Greg KH
2011-03-25 23:43 ` [05/63] ALSA: hda - VIA: Fix invalid A-A path volume adjust issue Greg KH
2011-03-25 23:43 ` [06/63] ALSA: hda - VIA: Fix codec type for VT1708BCE at the right timing Greg KH
2011-03-25 23:43 ` [07/63] ALSA: hda - VIA: Fix VT1708 cant build up Headphone control issue Greg KH
2011-03-25 23:43 ` [08/63] ASoC: mini2440: Fix uda134x codec problem Greg KH
2011-03-25 23:43 ` [09/63] ethtool: Compat handling for struct ethtool_rxnfc Greg KH
2011-03-25 23:43 ` [10/63] Revert "slab: Fix missing DEBUG_SLAB last user" Greg KH
2011-03-25 23:43 ` [11/63] aio: wake all waiters when destroying ctx Greg KH
2011-03-25 23:43 ` [12/63] cgroups: if you list_empty() a head then dont list_del() it Greg KH
2011-03-25 23:43 ` [13/63] shmem: let shared anonymous be nonlinear again Greg KH
2011-03-25 23:43 ` [14/63] mm: swap: unlock swapfile inode mutex before closing file on bad swapfiles Greg KH
2011-03-25 23:43 ` [15/63] mm: compaction: prevent kswapd compacting memory to reduce CPU usage Greg KH
2011-03-25 23:43 ` [16/63] oom: prevent unnecessary oom kills or kernel panics Greg KH
2011-03-25 23:43 ` [17/63] oom: skip zombies when iterating tasklist Greg KH
2011-03-25 23:43 ` [18/63] oom: avoid deferring oom killer if exiting task is being traced Greg KH
2011-03-25 23:43 ` [19/63] PCI hotplug: acpiphp: set current_state to D0 in register_slot Greg KH
2011-03-25 23:43 ` [20/63] Input: xen-kbdfront - advertise either absolute or relative coordinates Greg KH
2011-03-25 23:43 ` [21/63] xen: set max_pfn_mapped to the last pfn mapped Greg KH
2011-03-25 23:43 ` [22/63] Prevent rt_sigqueueinfo and rt_tgsigqueueinfo from spoofing the signal code Greg KH
2011-03-25 23:43 ` [23/63] ALSA: HDA: Fix internal mic on Dell E5420/E5520 Greg KH
2011-03-25 23:44 ` [24/63] mm: PageBuddy and mapcount robustness Greg KH
2011-03-25 23:44 ` [25/63] ext3: skip orphan cleanup on rocompat fs Greg KH
2011-03-25 23:44 ` [26/63] x86: Fix binutils-2.21 symbol related build failures Greg KH
2011-03-25 23:44 ` [27/63] sysctl: restrict write access to dmesg_restrict Greg KH
2011-03-25 23:44 ` [28/63] procfs: fix /proc/<pid>/maps heap check Greg KH
2011-03-25 23:44 ` [29/63] proc: protect mm start_code/end_code in /proc/pid/stat Greg KH
2011-03-25 23:44 ` [30/63] fbcon: Bugfix soft cursor detection in Tile Blitting Greg KH
2011-03-25 23:44 ` [31/63] nfsd41: modify the members value of nfsd4_op_flags Greg KH
2011-03-25 23:44 ` [32/63] nfsd4: minor nfs4state.c reshuffling Greg KH
2011-03-25 23:44 ` [33/63] nfsd4: fix struct file leak Greg KH
2011-03-25 23:44 ` [34/63] nfsd: wrong index used in inner loop Greg KH
2011-03-25 23:44 ` [35/63] [media] uvcvideo: Fix uvc_fixup_video_ctrl() format search Greg KH
2011-03-25 23:44 ` [36/63] [media] uvcvideo: Fix descriptor parsing for video output devices Greg KH
2011-03-25 23:44 ` [37/63] sh: Fix ptrace fpu state initialisation Greg KH
2011-03-25 23:44 ` [38/63] sh: Fix ptrace hw_breakpoint handling Greg KH
2011-03-25 23:44 ` [39/63] USB: Do not pass negative length to snoop_urb() Greg KH
2011-03-25 23:44 ` [40/63] ehci-hcd: Bug fix: dont set a QHs Halt bit Greg KH
2011-03-25 23:44 ` [41/63] usb: musb: blackfin: fix typo in platform driver name Greg KH
2011-03-25 23:44 ` [42/63] usb: musb: blackfin: fix typo in new dev_pm_ops struct Greg KH
2011-03-25 23:44 ` [43/63] usb: musb: blackfin: fix typo in new bfin_musb_vbus_status func Greg KH
2011-03-25 23:44 ` [44/63] USB: uss720 fixup refcount position Greg KH
2011-03-25 23:44 ` [45/63] USB: Fix bad dma problem on WDM device disconnect Greg KH
2011-03-25 23:44 ` [46/63] USB: cdc-acm: fix memory corruption / panic Greg KH
2011-03-25 23:44 ` [47/63] USB: cdc-acm: fix potential null-pointer dereference Greg KH
2011-03-25 23:44 ` [48/63] USB: cdc-acm: fix potential null-pointer dereference on disconnect Greg KH
2011-03-25 23:44 ` [49/63] fix deadlock in pivot_root() Greg KH
2011-03-25 23:44 ` [50/63] fs: assign sb->s_bdi to default_backing_dev_info if the bdi is going away Greg KH
2011-03-25 23:44 ` [51/63] x86: Cleanup highmap after brk is concluded Greg KH
2011-03-25 23:44 ` Greg KH [this message]
2011-03-25 23:44 ` [53/63] drm/i915: Disable pagefaults along execbuffer relocation fast path Greg KH
2011-03-25 23:44 ` [54/63] drm/i915: Prevent racy removal of request from client list Greg KH
2011-03-25 23:44 ` [55/63] drm: Fix use-after-free in drm_gem_vm_close() Greg KH
2011-03-25 23:44 ` [56/63] drm/radeon/kms: prefer legacy pll algo for tv-out Greg KH
2011-03-25 23:44 ` [57/63] drm/radeon/kms: fix hardcoded EDID handling Greg KH
2011-03-25 23:44 ` [58/63] perf: Fix tear-down of inherited group events Greg KH
2011-03-25 23:44 ` [59/63] NFS: Fix a hang/infinite loop in nfs_wb_page() Greg KH
2011-03-25 23:44 ` [60/63] SUNRPC: Never reuse the socket port after an xs_close() Greg KH
2011-03-25 23:44 ` [61/63] fs: call security_d_instantiate in d_obtain_alias V2 Greg KH
2011-03-25 23:44 ` [62/63] dcdbas: force SMI to happen when expected Greg KH
2011-03-25 23:44 ` [63/63] ext4: skip orphan cleanup if fs has unknown ROCOMPAT features Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110325234513.310545074@clark.kroah.org \
--to=gregkh@suse.de \
--cc=airlied@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®