summaryrefslogtreecommitdiff
path: root/drivers/gpu/drm/drm_framebuffer.c
diff options
context:
space:
mode:
authorChris Wilson <chris@chris-wilson.co.uk>2018-09-05 18:31:16 +0300
committerChris Wilson <chris@chris-wilson.co.uk>2018-09-06 10:07:41 +0300
commit70109354fed232dfce8fb2c7cadf635acbe03e19 (patch)
tree4a5332f978526920d708dab36d30393dbbdb7dbd /drivers/gpu/drm/drm_framebuffer.c
parent6960e6da9cec3f6638121527c728305827ec12ab (diff)
downloadlinux-70109354fed232dfce8fb2c7cadf635acbe03e19.tar.xz
drm: Reject unknown legacy bpp and depth for drm_mode_addfb ioctl
Since this is handling user provided bpp and depth, we need to sanity check and propagate the EINVAL back rather than assume what the insane client intended and fill the logs with DRM_ERROR. v2: Check both bpp and depth match the builtin pixel format, and introduce a canonical DRM_FORMAT_INVALID to reserve 0 against any future fourcc. v3: Mark up DRM_FORMAT_C8 as being {bpp:8, depth:8} Testcase: igt/kms_addfb_basic/legacy-format Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20180905153116.28924-1-chris@chris-wilson.co.uk
Diffstat (limited to 'drivers/gpu/drm/drm_framebuffer.c')
-rw-r--r--drivers/gpu/drm/drm_framebuffer.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index f863f8a20f8c..c8a7829d73d6 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -112,12 +112,17 @@ int drm_mode_addfb(struct drm_device *dev, struct drm_mode_fb_cmd *or,
struct drm_mode_fb_cmd2 r = {};
int ret;
+ r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
+ if (r.pixel_format == DRM_FORMAT_INVALID) {
+ DRM_DEBUG("bad {bpp:%d, depth:%d}\n", or->bpp, or->depth);
+ return -EINVAL;
+ }
+
/* convert to new format and call new ioctl */
r.fb_id = or->fb_id;
r.width = or->width;
r.height = or->height;
r.pitches[0] = or->pitch;
- r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
r.handles[0] = or->handle;
if (dev->mode_config.quirk_addfb_prefer_xbgr_30bpp &&