diff options
| author | Jakob Bornecrantz <jakob@vmware.com> | 2011-10-04 20:13:27 +0200 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2011-10-05 10:17:18 +0100 |
| commit | 0cff60c625131c64847debc2b4cee33ba33e8d8f (patch) | |
| tree | 5eb3cc5532639aff057231ff75719b4882caa01d /drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | |
| parent | 2fcd5a73bfd5341876f9ea6b5adcc1dd814226d4 (diff) | |
| download | olio-linux-3.10-0cff60c625131c64847debc2b4cee33ba33e8d8f.tar.xz olio-linux-3.10-0cff60c625131c64847debc2b4cee33ba33e8d8f.zip | |
vmwgfx: Disallow user space to send present and readback commands
Signed-off-by: Jakob Bornecrantz <jakob@vmware.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c')
| -rw-r--r-- | drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index c98c3475a9f..dea0474f6f3 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -197,6 +197,12 @@ static int vmw_cmd_blt_surf_screen_check(struct vmw_private *dev_priv, } *cmd; cmd = container_of(header, struct vmw_sid_cmd, header); + + if (unlikely(!sw_context->kernel)) { + DRM_ERROR("Kernel only SVGA3d command: %u.\n", cmd->header.id); + return -EPERM; + } + return vmw_cmd_sid_check(dev_priv, sw_context, &cmd->body.srcImage.sid); } @@ -210,6 +216,12 @@ static int vmw_cmd_present_check(struct vmw_private *dev_priv, } *cmd; cmd = container_of(header, struct vmw_sid_cmd, header); + + if (unlikely(!sw_context->kernel)) { + DRM_ERROR("Kernel only SVGA3d command: %u.\n", cmd->header.id); + return -EPERM; + } + return vmw_cmd_sid_check(dev_priv, sw_context, &cmd->body.sid); } @@ -478,14 +490,12 @@ static int vmw_cmd_check_not_3d(struct vmw_private *dev_priv, void *buf, uint32_t *size) { uint32_t size_remaining = *size; - bool need_kernel = true; uint32_t cmd_id; cmd_id = le32_to_cpu(((uint32_t *)buf)[0]); switch (cmd_id) { case SVGA_CMD_UPDATE: *size = sizeof(uint32_t) + sizeof(SVGAFifoCmdUpdate); - need_kernel = false; break; case SVGA_CMD_DEFINE_GMRFB: *size = sizeof(uint32_t) + sizeof(SVGAFifoCmdDefineGMRFB); @@ -507,7 +517,7 @@ static int vmw_cmd_check_not_3d(struct vmw_private *dev_priv, return -EINVAL; } - if (unlikely(need_kernel && !sw_context->kernel)) { + if (unlikely(!sw_context->kernel)) { DRM_ERROR("Kernel only SVGA command: %u.\n", cmd_id); return -EPERM; } |