From 0dd99f1bfc8a3661f095c00f9f86f5bafbd4fdff Mon Sep 17 00:00:00 2001 From: Andy Lutomirski Date: Mon, 13 May 2013 23:58:48 +0000 Subject: [PATCH] drm: Don't leak phys_wc "handles" to userspace I didn't fix this in the earlier patch -- it would have broken the build due to the now-deleted garbage in drm_os_linux.h. Reviewed-by: Daniel Vetter Signed-off-by: Andy Lutomirski Signed-off-by: Dave Airlie --- drivers/gpu/drm/drm_bufs.c | 9 +++++++++ drivers/gpu/drm/drm_ioctl.c | 15 ++++++++++++++- 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c index 0190fce..5a4dbb4 100644 --- a/drivers/gpu/drm/drm_bufs.c +++ b/drivers/gpu/drm/drm_bufs.c @@ -414,6 +414,15 @@ int drm_addmap_ioctl(struct drm_device *dev, void *data, /* avoid a warning on 64-bit, this casting isn't very nice, but the API is set so too late */ map->handle = (void *)(unsigned long)maplist->user_token; + + /* + * It appears that there are no users of this value whatsoever -- + * drmAddMap just discards it. Let's not encourage its use. + * (Keeping drm_addmap_core's returned mtrr value would be wrong -- + * it's not a real mtrr index anymore.) + */ + map->mtrr = -1; + return 0; } diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c index e77bd8b..ffd7a7b 100644 --- a/drivers/gpu/drm/drm_ioctl.c +++ b/drivers/gpu/drm/drm_ioctl.c @@ -38,6 +38,9 @@ #include #include +#ifdef CONFIG_X86 +#include +#endif /** * Get the bus id. @@ -181,7 +184,17 @@ int drm_getmap(struct drm_device *dev, void *data, map->type = r_list->map->type; map->flags = r_list->map->flags; map->handle = (void *)(unsigned long) r_list->user_token; - map->mtrr = r_list->map->mtrr; + +#ifdef CONFIG_X86 + /* + * There appears to be exactly one user of the mtrr index: dritest. + * It's easy enough to keep it working on non-PAT systems. + */ + map->mtrr = phys_wc_to_mtrr_index(r_list->map->mtrr); +#else + map->mtrr = -1; +#endif + mutex_unlock(&dev->struct_mutex); return 0; -- 2.7.4