Commit 4e9951d9 authored by Maarten Lankhorst's avatar Maarten Lankhorst Committed by Sean Paul
Browse files

drm/atomic: Reject properties not part of the object. 



The legacy setprop ioctl doesn't attempt to set properties
that are not enumerated on the object. The atomic ioctl does,
fix this by validating first.

Signed-off-by: default avatarMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: default avatarSean Paul <seanpaul@chromium.org>
Link: http://patchwork.freedesktop.org/patch/msgid/1473062773-5045-1-git-send-email-maarten.lankhorst@linux.intel.com
parent 75ac4953

drivers/gpu/drm/drm_atomic.c

+10 −1
Original line number Original line Diff line number Diff line
@@ -1609,7 +1609,7 @@ int drm_mode_atomic_ioctl(struct drm_device *dev, 
	struct drm_crtc_state *crtc_state;

	struct drm_crtc_state *crtc_state;

	unsigned plane_mask;

	unsigned plane_mask;

	int ret = 0;

	int ret = 0;

	unsigned int i, j;

	unsigned int i, j, k;





	/* disallow for drivers not supporting atomic: */

	/* disallow for drivers not supporting atomic: */

	if (!drm_core_check_feature(dev, DRIVER_ATOMIC))

	if (!drm_core_check_feature(dev, DRIVER_ATOMIC))
@@ -1691,6 +1691,15 @@ int drm_mode_atomic_ioctl(struct drm_device *dev, 
				goto out;

				goto out;

			}

			}





			for (k = 0; k < obj->properties->count; k++)

				if (obj->properties->properties[k]->base.id == prop_id)

					break;



			if (k == obj->properties->count) {

				ret = -EINVAL;

				goto out;

			}



			prop = drm_property_find(dev, prop_id);

			prop = drm_property_find(dev, prop_id);

			if (!prop) {

			if (!prop) {

				drm_mode_object_unreference(obj);

				drm_mode_object_unreference(obj);