diff options
| author | Andy Lutomirski <luto@amacapital.net> | 2013-05-13 23:58:48 (GMT) |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2013-05-31 03:37:39 (GMT) |
| commit | 0dd99f1bfc8a3661f095c00f9f86f5bafbd4fdff (patch) | |
| tree | 20f13d7a2e54acff0871bc92d111665e80dd0668 /drivers/gpu | |
| parent | 03dae7c567d24c49e826a033df45802ac9d1d6c8 (diff) | |
| download | linux-0dd99f1bfc8a3661f095c00f9f86f5bafbd4fdff.tar.xz | |
drm: Don't leak phys_wc "handles" to userspace
I didn't fix this in the earlier patch -- it would have broken the
build due to the now-deleted garbage in drm_os_linux.h.
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/drm_bufs.c | 9 | ||||
| -rw-r--r-- | drivers/gpu/drm/drm_ioctl.c | 15 |
2 files changed, 23 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c index 0190fce..5a4dbb4 100644 --- a/drivers/gpu/drm/drm_bufs.c +++ b/drivers/gpu/drm/drm_bufs.c @@ -414,6 +414,15 @@ int drm_addmap_ioctl(struct drm_device *dev, void *data, /* avoid a warning on 64-bit, this casting isn't very nice, but the API is set so too late */ map->handle = (void *)(unsigned long)maplist->user_token; + + /* + * It appears that there are no users of this value whatsoever -- + * drmAddMap just discards it. Let's not encourage its use. + * (Keeping drm_addmap_core's returned mtrr value would be wrong -- + * it's not a real mtrr index anymore.) + */ + map->mtrr = -1; + return 0; } diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c index e77bd8b..ffd7a7b 100644 --- a/drivers/gpu/drm/drm_ioctl.c +++ b/drivers/gpu/drm/drm_ioctl.c @@ -38,6 +38,9 @@ #include <linux/pci.h> #include <linux/export.h> +#ifdef CONFIG_X86 +#include <asm/mtrr.h> +#endif /** * Get the bus id. @@ -181,7 +184,17 @@ int drm_getmap(struct drm_device *dev, void *data, map->type = r_list->map->type; map->flags = r_list->map->flags; map->handle = (void *)(unsigned long) r_list->user_token; - map->mtrr = r_list->map->mtrr; + +#ifdef CONFIG_X86 + /* + * There appears to be exactly one user of the mtrr index: dritest. + * It's easy enough to keep it working on non-PAT systems. + */ + map->mtrr = phys_wc_to_mtrr_index(r_list->map->mtrr); +#else + map->mtrr = -1; +#endif + mutex_unlock(&dev->struct_mutex); return 0; |