drm/radeon: r100/r200 ums: block ability for userspace app to trash 0 page and beyond

commit 566d84d172161cb6c0c4dd834c34abbac6bf7b38 upstream.

radeon's have a special ability to passthrough writes in their internal
memory space directly to PCI, this ability means that if some of the internal
surfaces like the depth buffer point at 0x0, any writes to these will
go directly to RAM at 0x0 via PCI busmastering.

Now mesa used to always emit clears after emitting state, since the
radeon mesa driver was refactored a year or more ago, it was found it
could generate a clear request without ever sending any setup state to the
card. So the clear would attempt to clear the depth buffer at 0x0, which
would overwrite main memory at this point. fs corruption ensues.

Also once one app did this correctly, it would never get set back to 0
making this messy to reproduce.

The kernel should block this from happening as mesa runs without privs,
though it does require the user be connected to the current running X session.

This patch implements a check to make sure the depth offset has been set
before a depth clear occurs and if it finds one it prints a warning and
ignores the depth clear request. There is also a mesa fix to avoid sending
the badness going into mesa.

This only affects r100/r200 GPUs in user modesetting mode.

Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index 1c4684831e40231e52962892fd8d0a6530cf0ced..c7236f4c6cdd23c7cf6f67fe68f25af477637fe6 100644 (file)
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -1646,6 +1646,7 @@ static int radeon_do_resume_cp(struct drm_device *dev, struct drm_file *file_pri
        radeon_cp_load_microcode(dev_priv);
        radeon_cp_init_ring_buffer(dev, dev_priv, file_priv);
 
+       dev_priv->have_z_offset = 0;
        radeon_do_engine_reset(dev);
        radeon_irq_set_state(dev, RADEON_SW_INT_ENABLE, 1);
 

diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index 350962e0f346f483b02d04d37f48efb3219c2ed0..76e4070388c62383553ec818a5e2902c95b4b000 100644 (file)
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -267,6 +267,8 @@ typedef struct drm_radeon_private {
 
        u32 scratch_ages[5];
 
+       int have_z_offset;
+
        /* starting from here on, data is preserved accross an open */
        uint32_t flags;         /* see radeon_chip_flags */
        resource_size_t fb_aper_offset;

diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
index 38537d971a3e3b5a666fe24b8f63ee901b1c121e..f089493d5f70c65a75671bcf1daaf02489f6e3a0 100644 (file)
--- a/drivers/gpu/drm/radeon/radeon_state.c
+++ b/drivers/gpu/drm/radeon/radeon_state.c
@@ -101,6 +101,7 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
                        DRM_ERROR("Invalid depth buffer offset\n");
                        return -EINVAL;
                }
+               dev_priv->have_z_offset = 1;
                break;
 
        case RADEON_EMIT_PP_CNTL:
@@ -876,6 +877,11 @@ static void radeon_cp_dispatch_clear(struct drm_device * dev,
                if (tmp & RADEON_BACK)
                        flags |= RADEON_FRONT;
        }
+       if (flags & (RADEON_DEPTH|RADEON_STENCIL)) {
+               if (!dev_priv->have_z_offset)
+                       printk_once(KERN_ERR "radeon: illegal depth clear request. Buggy mesa detected - please update.\n");
+               flags &= ~(RADEON_DEPTH | RADEON_STENCIL);
+       }
 
        if (flags & (RADEON_FRONT | RADEON_BACK)) {