drm/rcar: gem: dumb: pitch is an output
authorThierry Reding <treding@nvidia.com>
Mon, 3 Nov 2014 11:08:24 +0000 (12:08 +0100)
committerSimon Horman <horms+renesas@verge.net.au>
Thu, 11 Dec 2014 01:36:58 +0000 (10:36 +0900)
commitdfecf259e1e190bfca8d649e537652ca9e457803
treeb4bb7a79df84a29979e035be6ecc4b8e24f9a960
parent0dc29459cf16720bd353e31191310427b259ebbb
drm/rcar: gem: dumb: pitch is an output

When creating a dumb buffer object using the DRM_IOCTL_MODE_CREATE_DUMB
IOCTL, only the width, height, bpp and flags fields are inputs. The
caller is not guaranteed to zero out or set handle, pitch and size.
Drivers must not treat these values as possible inputs, otherwise they
may use uninitialized memory during the computation of the framebuffer
size.

The R-Car DU driver treats the pitch passed in from userspace as minimum
and will only overwrite it when the driver-computed pitch is larger,
allowing userspace to, intentionally or not, overallocate framebuffers.

Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Thierry Reding <treding@nvidia.com>
(cherry picked from commit 7e295a36b3af5d588e585e2300febbb191463939)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
drivers/gpu/drm/rcar-du/rcar_du_kms.c