diff mbox

drm: Fix get_property logic fumble

Message ID 20170410115445.13829-1-daniel.vetter@ffwll.ch (mailing list archive)
State New, archived
Headers show

Commit Message

Daniel Vetter April 10, 2017, 11:54 a.m. UTC
Yet again I've proven that I can't negate conditions :(

Fixes: eb8eb02ed850 ("drm: Drop modeset_lock_all from the getproperty ioctl")
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Sean Paul <seanpaul@chromium.org>
Reported-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
---
 drivers/gpu/drm/drm_property.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Chris Wilson April 10, 2017, 12:37 p.m. UTC | #1
On Mon, Apr 10, 2017 at 01:54:45PM +0200, Daniel Vetter wrote:
> Yet again I've proven that I can't negate conditions :(
> 
> Fixes: eb8eb02ed850 ("drm: Drop modeset_lock_all from the getproperty ioctl")

You also get to write the igt/kms_getproperty, starting with a 
	memset(prop_values, 0xc5, foo);
	drmIoctl(GETPROPERTY);
	igt_assert(!memchr(prop_values, 0xc5, bar));
-Chris
Maarten Lankhorst April 10, 2017, 12:40 p.m. UTC | #2
Op 10-04-17 om 13:54 schreef Daniel Vetter:
> Yet again I've proven that I can't negate conditions :(
>
> Fixes: eb8eb02ed850 ("drm: Drop modeset_lock_all from the getproperty ioctl")
> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> Cc: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Jani Nikula <jani.nikula@linux.intel.com>
> Cc: Sean Paul <seanpaul@chromium.org>
> Reported-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> ---
>  drivers/gpu/drm/drm_property.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
> index 3feef0659940..3e88fa24eab3 100644
> --- a/drivers/gpu/drm/drm_property.c
> +++ b/drivers/gpu/drm/drm_property.c
> @@ -476,7 +476,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
>  	    drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
>  		list_for_each_entry(prop_enum, &property->enum_list, head) {
>  			enum_count++;
> -			if (out_resp->count_enum_blobs <= enum_count)
> +			if (out_resp->count_enum_blobs < enum_count)
>  				continue;
>  
>  			if (copy_to_user(&enum_ptr[copied].value,

Neither can I, glanced over it while looking why the bisect pointed at this commit.

Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Sean Paul April 10, 2017, 5:16 p.m. UTC | #3
On Mon, Apr 10, 2017 at 01:54:45PM +0200, Daniel Vetter wrote:
> Yet again I've proven that I can't negate conditions :(
> 
> Fixes: eb8eb02ed850 ("drm: Drop modeset_lock_all from the getproperty ioctl")
> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> Cc: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Jani Nikula <jani.nikula@linux.intel.com>
> Cc: Sean Paul <seanpaul@chromium.org>

Reviewed-by: Sean Paul <seanpaul@chromium.org>

> Reported-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> ---
>  drivers/gpu/drm/drm_property.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
> index 3feef0659940..3e88fa24eab3 100644
> --- a/drivers/gpu/drm/drm_property.c
> +++ b/drivers/gpu/drm/drm_property.c
> @@ -476,7 +476,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
>  	    drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
>  		list_for_each_entry(prop_enum, &property->enum_list, head) {
>  			enum_count++;
> -			if (out_resp->count_enum_blobs <= enum_count)
> +			if (out_resp->count_enum_blobs < enum_count)
>  				continue;
>  
>  			if (copy_to_user(&enum_ptr[copied].value,
> -- 
> 2.11.0
Daniel Vetter April 12, 2017, 3:18 p.m. UTC | #4
On Mon, Apr 10, 2017 at 01:37:01PM +0100, Chris Wilson wrote:
> On Mon, Apr 10, 2017 at 01:54:45PM +0200, Daniel Vetter wrote:
> > Yet again I've proven that I can't negate conditions :(
> > 
> > Fixes: eb8eb02ed850 ("drm: Drop modeset_lock_all from the getproperty ioctl")
> 
> You also get to write the igt/kms_getproperty, starting with a 
> 	memset(prop_values, 0xc5, foo);
> 	drmIoctl(GETPROPERTY);
> 	igt_assert(!memchr(prop_values, 0xc5, bar));

Testcase: igt/kms_properties/get_property-sanity

Thanks for reminding me to not be lazy with testing stuff we've broken!

Pushed the patch to -next-fixes.

Cheers, Daniel
Andres Rodriguez April 13, 2017, 8:44 p.m. UTC | #5
On 2017-04-10 08:40 AM, Maarten Lankhorst wrote:
> Op 10-04-17 om 13:54 schreef Daniel Vetter:
>> Yet again I've proven that I can't negate conditions :(
>>
>> Fixes: eb8eb02ed850 ("drm: Drop modeset_lock_all from the getproperty ioctl")
>> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
>> Cc: Daniel Vetter <daniel.vetter@intel.com>
>> Cc: Jani Nikula <jani.nikula@linux.intel.com>
>> Cc: Sean Paul <seanpaul@chromium.org>
>> Reported-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
>> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
>> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>> ---
>>  drivers/gpu/drm/drm_property.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
>> index 3feef0659940..3e88fa24eab3 100644
>> --- a/drivers/gpu/drm/drm_property.c
>> +++ b/drivers/gpu/drm/drm_property.c
>> @@ -476,7 +476,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
>>  	    drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
>>  		list_for_each_entry(prop_enum, &property->enum_list, head) {
>>  			enum_count++;
>> -			if (out_resp->count_enum_blobs <= enum_count)
>> +			if (out_resp->count_enum_blobs < enum_count)
>>  				continue;
>>
>>  			if (copy_to_user(&enum_ptr[copied].value,
>
> Neither can I, glanced over it while looking why the bisect pointed at this commit.

Same.

Tested-by: Andres Rodriguez <andresx7@gmail.com>

Fixes segfaults on xorg-video-amdgpu-1.1.2

>
> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
>
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel
>
diff mbox

Patch

diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
index 3feef0659940..3e88fa24eab3 100644
--- a/drivers/gpu/drm/drm_property.c
+++ b/drivers/gpu/drm/drm_property.c
@@ -476,7 +476,7 @@  int drm_mode_getproperty_ioctl(struct drm_device *dev,
 	    drm_property_type_is(property, DRM_MODE_PROP_BITMASK)) {
 		list_for_each_entry(prop_enum, &property->enum_list, head) {
 			enum_count++;
-			if (out_resp->count_enum_blobs <= enum_count)
+			if (out_resp->count_enum_blobs < enum_count)
 				continue;
 
 			if (copy_to_user(&enum_ptr[copied].value,