When constructing a path to a device node the minor number retrieved from fstat needs to have the offset of the node type subtracted from it. Control and render node types have the same major as the primary node but each has their own block of minor types at fixed offsets.
Signed-off-by: Jonathan Gray jsg@jsg.id.au --- xf86drm.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/xf86drm.c b/xf86drm.c index 2e8c956..6705605 100644 --- a/xf86drm.c +++ b/xf86drm.c @@ -2838,7 +2838,7 @@ out_close_dir: char buf[PATH_MAX + 1]; const char *dev_name; unsigned int maj, min; - int n; + int n, base;
if (fstat(fd, &sbuf)) return NULL; @@ -2863,7 +2863,11 @@ out_close_dir: return NULL; };
- n = snprintf(buf, sizeof(buf), dev_name, DRM_DIR_NAME, min); + base = drmGetMinorBase(type); + if (base < 0 || min < base) + return NULL; + + n = snprintf(buf, sizeof(buf), dev_name, DRM_DIR_NAME, min - base); if (n == -1 || n >= sizeof(buf)) return NULL;
@@ -3262,7 +3266,7 @@ int drmGetDevice2(int fd, uint32_t flags, drmDevicePtr *device) char node[PATH_MAX + 1]; const char *dev_name; int node_type, subsystem_type; - int maj, min, n, ret; + int maj, min, n, ret, base;
if (fd == -1 || device == NULL) return -EINVAL; @@ -3294,7 +3298,11 @@ int drmGetDevice2(int fd, uint32_t flags, drmDevicePtr *device) return -EINVAL; };
- n = snprintf(node, PATH_MAX, dev_name, DRM_DIR_NAME, min); + base = drmGetMinorBase(node_type); + if (base < 0 || min < base) + return -EINVAL; + + n = snprintf(node, PATH_MAX, dev_name, DRM_DIR_NAME, min - base); if (n == -1 || n >= PATH_MAX) return -errno; if (stat(node, &sbuf))