Skip to contentSkip to conversation

drm: stop vmgfx driver explosion

PATCH In review Alan Cox 2 participants 2 messages Aug 20, 2012

Subsystems (3)
DRM drivers DRM misc DRM driver for VMware virtual GPU
lore
Share & tools
lore

Alan Cox

author
#0 lore raw

PATCH 1/1 drm: stop vmgfx driver explosion

From: Alan Cox <[email protected]>

If you do a page flip with no flags set then event is NULL. If event is NULL then the vmw_gfx driver likes to go digging into NULL and extracts NULL->base.file_priv.

On a modern kernel with NULL mapping protection it's just another oops, without it there are some "intriguing" possibilities.

What it should do is an open question but that for the driver owners to sort out.

Signed-off-by Alan Cox <[email protected]>

---

 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +5 -1
index 6b0078f..c50724b 100644
@@ -1688,15 +1688,19 @@ int vmw_du_page_flip(struct drm_crtc *crtc,
 	struct vmw_private *dev_priv = vmw_priv(crtc->dev);
 	struct drm_framebuffer *old_fb = crtc->fb;
 	struct vmw_framebuffer *vfb = vmw_framebuffer_to_vfb(fb);
-	struct drm_file *file_priv = event->base.file_priv;
+	struct drm_file *file_priv ;
 	struct vmw_fence_obj *fence = NULL;
 	struct drm_clip_rect clips;
 	int ret;
 
+	if (event == NULL)
+		return -EINVAL;
+
 	/* require ScreenObject support for page flipping */
 	if (!dev_priv->sou_priv)
 		return -ENOSYS;
 
+	file_priv = event->base.file_priv;
 	if (!vmw_kms_screen_object_flippable(dev_priv, crtc))
 		return -EINVAL;
Reviewed-by on v1 1/1
#1 lore raw

----- Original Message -----

Quoted 6 lines

From: Alan Cox <[email protected]>

If you do a page flip with no flags set then event is NULL. If event is NULL then the vmw_gfx driver likes to go digging into NULL and extracts NULL->base.file_priv.

Quoted 7 lines

On a modern kernel with NULL mapping protection it's just another oops, without it there are some "intriguing" possibilities.

What it should do is an open question but that for the driver owners to sort out.

Signed-off-by Alan Cox <[email protected]>

Thanks Alan!

Reviewed-by Jakob Bornecrantz <[email protected]>

I think CC stable is in order.

Cheers, Jakob.