drm/atomic: Reject properties not part of the object.

The legacy setprop ioctl doesn't attempt to set properties
that are not enumerated on the object. The atomic ioctl does,
fix this by validating first.

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: http://patchwork.freedesktop.org/patch/msgid/1473062773-5045-1-git-send-email-maarten.lankhorst@linux.intel.com

diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 5cb2e22d5d55e406dc011fefbe6c29d8dcf52d0a..a5126e5c05ee9f491ab6eb98fe2c8e030024175e 100644 (file)
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -1609,7 +1609,7 @@ int drm_mode_atomic_ioctl(struct drm_device *dev,
        struct drm_crtc_state *crtc_state;
        unsigned plane_mask;
        int ret = 0;
-       unsigned int i, j;
+       unsigned int i, j, k;
 
        /* disallow for drivers not supporting atomic: */
        if (!drm_core_check_feature(dev, DRIVER_ATOMIC))
@@ -1691,6 +1691,15 @@ retry:
                                goto out;
                        }
 
+                       for (k = 0; k < obj->properties->count; k++)
+                               if (obj->properties->properties[k]->base.id == prop_id)
+                                       break;
+
+                       if (k == obj->properties->count) {
+                               ret = -EINVAL;
+                               goto out;
+                       }
+
                        prop = drm_property_find(dev, prop_id);
                        if (!prop) {
                                drm_mode_object_unreference(obj);