drm/radeon/kms: check AA resolve registers on r300

This is an important security fix because we allowed arbitrary values
to be passed to AARESOLVE_OFFSET. This also puts the right buffer address
in the register.

Signed-off-by: Marek Olšák <maraeo@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

1 files changed, 23 insertions, 0 deletions

diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index fdf4bc67ae58..56deae5bf02e 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -3381,6 +3381,26 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
         }
         track->zb_dirty = false;
 
+        if (track->aa_dirty && track->aaresolve) {
+                if (track->aa.robj == NULL) {
+                        DRM_ERROR("[drm] No buffer for AA resolve buffer %d !\n", i);
+                        return -EINVAL;
+                }
+                /* I believe the format comes from colorbuffer0. */
+                size = track->aa.pitch * track->cb[0].cpp * track->maxy;
+                size += track->aa.offset;
+                if (size > radeon_bo_size(track->aa.robj)) {
+                        DRM_ERROR("[drm] Buffer too small for AA resolve buffer %d "
+                                  "(need %lu have %lu) !\n", i, size,
+                                  radeon_bo_size(track->aa.robj));
+                        DRM_ERROR("[drm] AA resolve buffer %d (%u %u %u %u)\n",
+                                  i, track->aa.pitch, track->cb[0].cpp,
+                                  track->aa.offset, track->maxy);
+                        return -EINVAL;
+                }
+        }
+        track->aa_dirty = false;
+
         prim_walk = (track->vap_vf_cntl >> 4) & 0x3;
         if (track->vap_vf_cntl & (1 << 14)) {
                 nverts = track->vap_alt_nverts;
@@ -3455,6 +3475,7 @@ void r100_cs_track_clear(struct radeon_device *rdev, struct r100_cs_track *track
         track->cb_dirty = true;
         track->zb_dirty = true;
         track->tex_dirty = true;
+        track->aa_dirty = true;
 
         if (rdev->family < CHIP_R300) {
                 track->num_cb = 1;
@@ -3469,6 +3490,8 @@ void r100_cs_track_clear(struct radeon_device *rdev, struct r100_cs_track *track
                 track->num_texture = 16;
                 track->maxy = 4096;
                 track->separate_cube = 0;
+                track->aaresolve = true;
+                track->aa.robj = NULL;
         }
 
         for (i = 0; i < track->num_cb; i++) {