drm/gem: Ignore color planes that are unused by framebuffer format

Only handle color planes that exist in a framebuffer's color format.
Ignore non-existing planes.

So far, several helpers assumed that all 4 planes are available and
silently ignored non-existing planes. This lead to subtil bugs with
uninitialized data in instances of struct iosys_map. [1]

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Tested-by: Noralf Trønnes <noralf@tronnes.org>
Acked-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/dri-devel/20210730183511.20080-1-tzimmermann@suse.de/T/#md0172b10bb588d8f20f4f456e304f08d2a4505f7
Link: https://patchwork.freedesktop.org/patch/msgid/20220517113327.26919-3-tzimmermann@suse.de

diff --git a/drivers/gpu/drm/drm_gem_atomic_helper.c b/drivers/gpu/drm/drm_gem_atomic_helper.c
index a5026f6177394312b9429a17cf6ddce5a4fe778b..f16d60217c6cb8e88a42e0800a9d7226c7414211 100644 (file)
--- a/drivers/gpu/drm/drm_gem_atomic_helper.c
+++ b/drivers/gpu/drm/drm_gem_atomic_helper.c
@@ -169,8 +169,10 @@ int drm_gem_plane_helper_prepare_fb(struct drm_plane *plane,
                struct drm_gem_object *obj = drm_gem_fb_get_obj(state->fb, i);
                struct dma_fence *new;
 
-               if (WARN_ON_ONCE(!obj))
-                       continue;
+               if (!obj) {
+                       ret = -EINVAL;
+                       goto error;
+               }
 
                ret = dma_resv_get_singleton(obj->resv, usage, &new);
                if (ret)

diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
index 931828784dfe184d6dc66aebef5a8ce2e7e54211..6d3c26efdeeb6f9e8c26c91395a04087c6c67396 100644 (file)
--- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c
+++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
@@ -92,9 +92,9 @@ drm_gem_fb_init(struct drm_device *dev,
  */
 void drm_gem_fb_destroy(struct drm_framebuffer *fb)
 {
-       size_t i;
+       unsigned int i;
 
-       for (i = 0; i < ARRAY_SIZE(fb->obj); i++)
+       for (i = 0; i < fb->format->num_planes; i++)
                drm_gem_object_put(fb->obj[i]);
 
        drm_framebuffer_cleanup(fb);
@@ -329,24 +329,26 @@ EXPORT_SYMBOL_GPL(drm_gem_fb_create_with_dirty);
  * The argument returns the addresses of the data stored in each BO. This
  * is different from @map if the framebuffer's offsets field is non-zero.
  *
+ * Both, @map and @data, must each refer to arrays with at least
+ * fb->format->num_planes elements.
+ *
  * See drm_gem_fb_vunmap() for unmapping.
  *
  * Returns:
  * 0 on success, or a negative errno code otherwise.
  */
-int drm_gem_fb_vmap(struct drm_framebuffer *fb,
-                   struct iosys_map map[static DRM_FORMAT_MAX_PLANES],
-                   struct iosys_map data[DRM_FORMAT_MAX_PLANES])
+int drm_gem_fb_vmap(struct drm_framebuffer *fb, struct iosys_map *map,
+                   struct iosys_map *data)
 {
        struct drm_gem_object *obj;
        unsigned int i;
        int ret;
 
-       for (i = 0; i < DRM_FORMAT_MAX_PLANES; ++i) {
+       for (i = 0; i < fb->format->num_planes; ++i) {
                obj = drm_gem_fb_get_obj(fb, i);
                if (!obj) {
-                       iosys_map_clear(&map[i]);
-                       continue;
+                       ret = -EINVAL;
+                       goto err_drm_gem_vunmap;
                }
                ret = drm_gem_vmap(obj, &map[i]);
                if (ret)
@@ -354,7 +356,7 @@ int drm_gem_fb_vmap(struct drm_framebuffer *fb,
        }
 
        if (data) {
-               for (i = 0; i < DRM_FORMAT_MAX_PLANES; ++i) {
+               for (i = 0; i < fb->format->num_planes; ++i) {
                        memcpy(&data[i], &map[i], sizeof(data[i]));
                        if (iosys_map_is_null(&data[i]))
                                continue;
@@ -385,10 +387,9 @@ EXPORT_SYMBOL(drm_gem_fb_vmap);
  *
  * See drm_gem_fb_vmap() for more information.
  */
-void drm_gem_fb_vunmap(struct drm_framebuffer *fb,
-                      struct iosys_map map[static DRM_FORMAT_MAX_PLANES])
+void drm_gem_fb_vunmap(struct drm_framebuffer *fb, struct iosys_map *map)
 {
-       unsigned int i = DRM_FORMAT_MAX_PLANES;
+       unsigned int i = fb->format->num_planes;
        struct drm_gem_object *obj;
 
        while (i) {
@@ -443,13 +444,15 @@ int drm_gem_fb_begin_cpu_access(struct drm_framebuffer *fb, enum dma_data_direct
 {
        struct dma_buf_attachment *import_attach;
        struct drm_gem_object *obj;
-       size_t i;
+       unsigned int i;
        int ret;
 
-       for (i = 0; i < ARRAY_SIZE(fb->obj); ++i) {
+       for (i = 0; i < fb->format->num_planes; ++i) {
                obj = drm_gem_fb_get_obj(fb, i);
-               if (!obj)
-                       continue;
+               if (!obj) {
+                       ret = -EINVAL;
+                       goto err___drm_gem_fb_end_cpu_access;
+               }
                import_attach = obj->import_attach;
                if (!import_attach)
                        continue;
@@ -479,7 +482,7 @@ EXPORT_SYMBOL(drm_gem_fb_begin_cpu_access);
  */
 void drm_gem_fb_end_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir)
 {
-       __drm_gem_fb_end_cpu_access(fb, dir, ARRAY_SIZE(fb->obj));
+       __drm_gem_fb_end_cpu_access(fb, dir, fb->format->num_planes);
 }
 EXPORT_SYMBOL(drm_gem_fb_end_cpu_access);
 

diff --git a/include/drm/drm_gem_framebuffer_helper.h b/include/drm/drm_gem_framebuffer_helper.h
index 1091e4fa08cb85eeecff51516befb6e0aabc099e..d302521f3dd48204b7b0c4c67cd718373becdd82 100644 (file)
--- a/include/drm/drm_gem_framebuffer_helper.h
+++ b/include/drm/drm_gem_framebuffer_helper.h
@@ -4,8 +4,6 @@
 #include <linux/dma-buf.h>
 #include <linux/iosys-map.h>
 
-#include <drm/drm_fourcc.h>
-
 struct drm_afbc_framebuffer;
 struct drm_device;
 struct drm_fb_helper_surface_size;
@@ -39,11 +37,9 @@ struct drm_framebuffer *
 drm_gem_fb_create_with_dirty(struct drm_device *dev, struct drm_file *file,
                             const struct drm_mode_fb_cmd2 *mode_cmd);
 
-int drm_gem_fb_vmap(struct drm_framebuffer *fb,
-                   struct iosys_map map[static DRM_FORMAT_MAX_PLANES],
-                   struct iosys_map data[DRM_FORMAT_MAX_PLANES]);
-void drm_gem_fb_vunmap(struct drm_framebuffer *fb,
-                      struct iosys_map map[static DRM_FORMAT_MAX_PLANES]);
+int drm_gem_fb_vmap(struct drm_framebuffer *fb, struct iosys_map *map,
+                   struct iosys_map *data);
+void drm_gem_fb_vunmap(struct drm_framebuffer *fb, struct iosys_map *map);
 int drm_gem_fb_begin_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir);
 void drm_gem_fb_end_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir);