xserver/hw/xfree86/os-support/linux/lnx_video.c

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

192 lines
4.7 KiB
C
Raw Normal View History

2003-11-14 15:54:54 +00:00
/*
* Copyright 1992 by Orest Zborowski <obz@Kodak.com>
* Copyright 1993 by David Wexelblat <dwex@goblin.org>
*
* Permission to use, copy, modify, distribute, and sell this software and its
* documentation for any purpose is hereby granted without fee, provided that
* the above copyright notice appear in all copies and that both that
* copyright notice and this permission notice appear in supporting
* documentation, and that the names of Orest Zborowski and David Wexelblat
* not be used in advertising or publicity pertaining to distribution of
* the software without specific, written prior permission. Orest Zborowski
* and David Wexelblat make no representations about the suitability of this
* software for any purpose. It is provided "as is" without express or
* implied warranty.
*
* OREST ZBOROWSKI AND DAVID WEXELBLAT DISCLAIMS ALL WARRANTIES WITH REGARD
* TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
* FITNESS, IN NO EVENT SHALL OREST ZBOROWSKI OR DAVID WEXELBLAT BE LIABLE
* FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*
*/
#ifdef HAVE_XORG_CONFIG_H
#include <xorg-config.h>
#endif
#include <errno.h>
#include <string.h>
#include <sys/mman.h>
#include <X11/X.h>
2003-11-14 15:54:54 +00:00
#include "input.h"
#include "scrnintstr.h"
#include "xf86.h"
#include "xf86_os_support.h"
2003-11-14 15:54:54 +00:00
#include "xf86Priv.h"
#include "xf86_OSlib.h"
2003-11-14 16:49:22 +00:00
static Bool ExtendedEnabled = FALSE;
#ifdef __ia64__
#include "compiler.h"
#include <sys/io.h>
#elif !defined(__powerpc__) && \
!defined(__mc68000__) && \
!defined(__sparc__) && \
2007-06-18 12:05:55 -04:00
!defined(__mips__) && \
!defined(__nds32__) && \
!defined(__arm__) && \
!defined(__aarch64__) && \
!defined(__arc__) && \
!defined(__xtensa__)
2003-11-14 15:54:54 +00:00
/*
2003-11-14 16:49:22 +00:00
* Due to conflicts with "compiler.h", don't rely on <sys/io.h> to declare
* these.
2003-11-14 15:54:54 +00:00
*/
2003-11-14 16:49:22 +00:00
extern int ioperm(unsigned long __from, unsigned long __num, int __turn_on);
extern int iopl(int __level);
2003-11-14 15:54:54 +00:00
#endif
/***************************************************************************/
2003-11-14 16:49:22 +00:00
/* Video Memory Mapping section */
2003-11-14 15:54:54 +00:00
/***************************************************************************/
2003-11-14 16:49:22 +00:00
void
xf86OSInitVidMem(VidMemInfoPtr pVidMem)
{
pVidMem->initialised = TRUE;
2003-11-14 15:54:54 +00:00
}
2003-11-14 16:49:22 +00:00
/***************************************************************************/
/* I/O Permissions section */
/***************************************************************************/
#if defined(__powerpc__)
volatile unsigned char *ioBase = NULL;
2003-11-14 16:49:22 +00:00
#ifndef __NR_pciconfig_iobase
#define __NR_pciconfig_iobase 200
2003-11-14 15:54:54 +00:00
#endif
static Bool
hwEnableIO(void)
2003-11-14 16:49:22 +00:00
{
int fd;
unsigned int ioBase_phys = syscall(__NR_pciconfig_iobase, 2, 0, 0);
2003-11-14 16:49:22 +00:00
fd = open("/dev/mem", O_RDWR);
if (ioBase == NULL) {
ioBase = (volatile unsigned char *) mmap(0, 0x20000,
PROT_READ | PROT_WRITE,
MAP_SHARED, fd, ioBase_phys);
2003-11-14 15:54:54 +00:00
}
2003-11-14 16:49:22 +00:00
close(fd);
return ioBase != MAP_FAILED;
}
static void
hwDisableIO(void)
{
munmap(ioBase, 0x20000);
ioBase = NULL;
}
#elif defined(__i386__) || defined(__x86_64__) || defined(__ia64__) || \
defined(__alpha__)
static Bool
hwEnableIO(void)
{
2019-05-02 16:25:50 -05:00
short i;
size_t n=0;
int begin, end;
xfree86: NUL-terminate strings in hwEnableIO The Linux version of xf86EnableIO calls a helper function called hwEnableIO(). Except on Alpha, this function reads /proc/ioports looking for the 'keyboard' and 'timer' ports, extracts the port ranges, and enables access to them. It does this by reading 4 bytes from the string for the start port number and 4 bytes for the last port number, passing those to atoi(). However, it doesn't add a fifth byte for a NUL terminator, so some implementations of atoi() read past the end of this string, triggering an AddressSanitizer error: ==1383==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff71fd5b74 at pc 0x7fe1be0de3e0 bp 0x7fff71fd5ae0 sp 0x7fff71fd5288 READ of size 5 at 0x7fff71fd5b74 thread T0 #0 0x7fe1be0de3df in __interceptor_atoi /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cpp:520 #1 0x564971adcc45 in hwEnableIO ../hw/xfree86/os-support/linux/lnx_video.c:138 #2 0x564971adce87 in xf86EnableIO ../hw/xfree86/os-support/linux/lnx_video.c:174 #3 0x5649719f6a30 in InitOutput ../hw/xfree86/common/xf86Init.c:439 #4 0x564971585924 in dix_main ../dix/main.c:190 #5 0x564971b6246e in main ../dix/stubmain.c:34 #6 0x7fe1bdab6b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24) #7 0x564971490e9d in _start (/home/aaron/git/x/xserver/build.asan/hw/xfree86/Xorg+0xb2e9d) Address 0x7fff71fd5b74 is located in stack of thread T0 at offset 100 in frame #0 0x564971adc96a in hwEnableIO ../hw/xfree86/os-support/linux/lnx_video.c:118 This frame has 3 object(s): [32, 40) 'n' (line 120) [64, 72) 'buf' (line 122) [96, 100) 'target' (line 122) <== Memory access at offset 100 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cpp:520 in __interceptor_atoi Shadow bytes around the buggy address: 0x10006e3f2b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10006e3f2b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10006e3f2b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10006e3f2b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10006e3f2b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x10006e3f2b60: 00 00 f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2[04]f3 0x10006e3f2b70: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10006e3f2b80: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 0x10006e3f2b90: f1 f1 f8 f2 00 f2 f2 f2 f8 f3 f3 f3 00 00 00 00 0x10006e3f2ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 0x10006e3f2bb0: f1 f1 00 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==1383==ABORTING Fix this by NUL-terminating the string. Fixes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1193#note_1053306 Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
2021-09-10 11:02:00 -07:00
char *buf=NULL, target[5];
2019-05-02 16:25:50 -05:00
FILE *fp;
if (ioperm(0, 1024, 1) || iopl(3)) {
ErrorF("xf86EnableIO: failed to enable I/O ports access (%s)\n",
strerror(errno));
return FALSE;
}
2019-05-02 16:25:50 -05:00
2003-11-14 16:49:22 +00:00
#if !defined(__alpha__)
xfree86: NUL-terminate strings in hwEnableIO The Linux version of xf86EnableIO calls a helper function called hwEnableIO(). Except on Alpha, this function reads /proc/ioports looking for the 'keyboard' and 'timer' ports, extracts the port ranges, and enables access to them. It does this by reading 4 bytes from the string for the start port number and 4 bytes for the last port number, passing those to atoi(). However, it doesn't add a fifth byte for a NUL terminator, so some implementations of atoi() read past the end of this string, triggering an AddressSanitizer error: ==1383==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff71fd5b74 at pc 0x7fe1be0de3e0 bp 0x7fff71fd5ae0 sp 0x7fff71fd5288 READ of size 5 at 0x7fff71fd5b74 thread T0 #0 0x7fe1be0de3df in __interceptor_atoi /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cpp:520 #1 0x564971adcc45 in hwEnableIO ../hw/xfree86/os-support/linux/lnx_video.c:138 #2 0x564971adce87 in xf86EnableIO ../hw/xfree86/os-support/linux/lnx_video.c:174 #3 0x5649719f6a30 in InitOutput ../hw/xfree86/common/xf86Init.c:439 #4 0x564971585924 in dix_main ../dix/main.c:190 #5 0x564971b6246e in main ../dix/stubmain.c:34 #6 0x7fe1bdab6b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24) #7 0x564971490e9d in _start (/home/aaron/git/x/xserver/build.asan/hw/xfree86/Xorg+0xb2e9d) Address 0x7fff71fd5b74 is located in stack of thread T0 at offset 100 in frame #0 0x564971adc96a in hwEnableIO ../hw/xfree86/os-support/linux/lnx_video.c:118 This frame has 3 object(s): [32, 40) 'n' (line 120) [64, 72) 'buf' (line 122) [96, 100) 'target' (line 122) <== Memory access at offset 100 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cpp:520 in __interceptor_atoi Shadow bytes around the buggy address: 0x10006e3f2b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10006e3f2b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10006e3f2b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10006e3f2b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10006e3f2b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x10006e3f2b60: 00 00 f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2[04]f3 0x10006e3f2b70: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10006e3f2b80: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 0x10006e3f2b90: f1 f1 f8 f2 00 f2 f2 f2 f8 f3 f3 f3 00 00 00 00 0x10006e3f2ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 0x10006e3f2bb0: f1 f1 00 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==1383==ABORTING Fix this by NUL-terminating the string. Fixes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1193#note_1053306 Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
2021-09-10 11:02:00 -07:00
target[4] = '\0';
2019-05-02 16:25:50 -05:00
/* trap access to the keyboard controller(s) and timer chip(s) */
fp = fopen("/proc/ioports", "r");
while (getline(&buf, &n, fp) != -1) {
if ((strstr(buf, "keyboard") != NULL) || (strstr(buf, "timer") != NULL)) {
for (i=0; i<4; i++)
target[i] = buf[i+2];
begin = atoi(target);
for (i=0; i<4; i++)
target[i] = buf[i+7];
end = atoi(target);
ioperm(begin, end-begin+1, 0);
}
}
free(buf);
fclose(fp);
2003-11-14 16:49:22 +00:00
#endif
return TRUE;
2003-11-14 15:54:54 +00:00
}
static void
hwDisableIO(void)
{
iopl(0);
ioperm(0, 1024, 0);
}
#else /* non-IO architectures */
#define hwEnableIO() TRUE
#define hwDisableIO() do {} while (0)
#endif
Bool
xf86EnableIO(void)
{
if (ExtendedEnabled)
return TRUE;
ExtendedEnabled = hwEnableIO();
return ExtendedEnabled;
}
void
2003-11-14 16:49:22 +00:00
xf86DisableIO(void)
2003-11-14 15:54:54 +00:00
{
2003-11-14 16:49:22 +00:00
if (!ExtendedEnabled)
return;
hwDisableIO();
ExtendedEnabled = FALSE;
2003-11-14 15:54:54 +00:00
}