From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Lyude Paul <lyude@redhat.com>,
Neil Armstrong <narmstrong@baylibre.com>,
Maxime Ripard <maxime.ripard@bootlin.com>,
Carlo Caione <carlo@caione.org>,
Kevin Hilman <khilman@baylibre.com>,
dri-devel@lists.freedesktop.org,
linux-amlogic@lists.infradead.org,
linux-arm-kernel@lists.infradead.org,
Sean Paul <seanpaul@chromium.org>
Subject: [PATCH 4.19 20/41] drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut()
Date: Thu, 6 Dec 2018 15:39:00 +0100 [thread overview]
Message-ID: <20181206142951.442912428@linuxfoundation.org> (raw)
In-Reply-To: <20181206142949.757402551@linuxfoundation.org>
4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude Paul <lyude@redhat.com>
commit 97b2a3180a559a33852ac0cd77904166069484fd upstream.
Currently on driver bringup with KASAN enabled, meson triggers an OOB
memory access as shown below:
[ 117.904528] ==================================================================
[ 117.904560] BUG: KASAN: global-out-of-bounds in meson_viu_set_osd_lut+0x7a0/0x890
[ 117.904588] Read of size 4 at addr ffff20000a63ce24 by task systemd-udevd/498
[ 117.904601]
[ 118.083372] CPU: 4 PID: 498 Comm: systemd-udevd Not tainted 4.20.0-rc3Lyude-Test+ #20
[ 118.091143] Hardware name: amlogic khadas-vim2/khadas-vim2, BIOS 2018.07-rc2-armbian 09/11/2018
[ 118.099768] Call trace:
[ 118.102181] dump_backtrace+0x0/0x3e8
[ 118.105796] show_stack+0x14/0x20
[ 118.109083] dump_stack+0x130/0x1c4
[ 118.112539] print_address_description+0x60/0x25c
[ 118.117214] kasan_report+0x1b4/0x368
[ 118.120851] __asan_report_load4_noabort+0x18/0x20
[ 118.125566] meson_viu_set_osd_lut+0x7a0/0x890
[ 118.129953] meson_viu_init+0x10c/0x290
[ 118.133741] meson_drv_bind_master+0x474/0x748
[ 118.138141] meson_drv_bind+0x10/0x18
[ 118.141760] try_to_bring_up_master+0x3d8/0x768
[ 118.146249] component_add+0x214/0x570
[ 118.149978] meson_dw_hdmi_probe+0x18/0x20 [meson_dw_hdmi]
[ 118.155404] platform_drv_probe+0x98/0x138
[ 118.159455] really_probe+0x2a0/0xa70
[ 118.163070] driver_probe_device+0x1b4/0x2d8
[ 118.167299] __driver_attach+0x200/0x280
[ 118.171189] bus_for_each_dev+0x10c/0x1a8
[ 118.175144] driver_attach+0x38/0x50
[ 118.178681] bus_add_driver+0x330/0x608
[ 118.182471] driver_register+0x140/0x388
[ 118.186361] __platform_driver_register+0xc8/0x108
[ 118.191117] meson_dw_hdmi_platform_driver_init+0x1c/0x1000 [meson_dw_hdmi]
[ 118.198022] do_one_initcall+0x12c/0x3bc
[ 118.201883] do_init_module+0x1fc/0x638
[ 118.205673] load_module+0x4b4c/0x6808
[ 118.209387] __se_sys_init_module+0x2e8/0x3c0
[ 118.213699] __arm64_sys_init_module+0x68/0x98
[ 118.218100] el0_svc_common+0x104/0x210
[ 118.221893] el0_svc_handler+0x48/0xb8
[ 118.225594] el0_svc+0x8/0xc
[ 118.228429]
[ 118.229887] The buggy address belongs to the variable:
[ 118.235007] eotf_33_linear_mapping+0x84/0xc0
[ 118.239301]
[ 118.240752] Memory state around the buggy address:
[ 118.245522] ffff20000a63cd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 118.252695] ffff20000a63cd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 118.259850] >ffff20000a63ce00: 00 00 00 00 04 fa fa fa fa fa fa fa 00 00 00 00
[ 118.267000] ^
[ 118.271222] ffff20000a63ce80: 00 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
[ 118.278393] ffff20000a63cf00: 00 00 00 00 00 00 00 00 00 00 00 00 04 fa fa fa
[ 118.285542] ==================================================================
[ 118.292699] Disabling lock debugging due to kernel taint
It seems that when looping through the OSD EOTF LUT maps, we use the
same max iterator for OETF: 20. This is wrong though, since 20*2 is 40,
which means that we'll stop out of bounds on the EOTF maps.
But, this whole thing is already confusing enough to read through as-is,
so let's just replace all of the hardcoded sizes with
OSD_(OETF/EOTF)_LUT_SIZE / 2.
Signed-off-by: Lyude Paul <lyude@redhat.com>
Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller")
Cc: Neil Armstrong <narmstrong@baylibre.com>
Cc: Maxime Ripard <maxime.ripard@bootlin.com>
Cc: Carlo Caione <carlo@caione.org>
Cc: Kevin Hilman <khilman@baylibre.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-amlogic@lists.infradead.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: <stable@vger.kernel.org> # v4.10+
Acked-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181125012117.31915-1-lyude@redhat.com
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/meson/meson_viu.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/gpu/drm/meson/meson_viu.c
+++ b/drivers/gpu/drm/meson/meson_viu.c
@@ -184,18 +184,18 @@ void meson_viu_set_osd_lut(struct meson_
if (lut_sel == VIU_LUT_OSD_OETF) {
writel(0, priv->io_base + _REG(addr_port));
- for (i = 0; i < 20; i++)
+ for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++)
writel(r_map[i * 2] | (r_map[i * 2 + 1] << 16),
priv->io_base + _REG(data_port));
writel(r_map[OSD_OETF_LUT_SIZE - 1] | (g_map[0] << 16),
priv->io_base + _REG(data_port));
- for (i = 0; i < 20; i++)
+ for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++)
writel(g_map[i * 2 + 1] | (g_map[i * 2 + 2] << 16),
priv->io_base + _REG(data_port));
- for (i = 0; i < 20; i++)
+ for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++)
writel(b_map[i * 2] | (b_map[i * 2 + 1] << 16),
priv->io_base + _REG(data_port));
@@ -211,18 +211,18 @@ void meson_viu_set_osd_lut(struct meson_
} else if (lut_sel == VIU_LUT_OSD_EOTF) {
writel(0, priv->io_base + _REG(addr_port));
- for (i = 0; i < 20; i++)
+ for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++)
writel(r_map[i * 2] | (r_map[i * 2 + 1] << 16),
priv->io_base + _REG(data_port));
writel(r_map[OSD_EOTF_LUT_SIZE - 1] | (g_map[0] << 16),
priv->io_base + _REG(data_port));
- for (i = 0; i < 20; i++)
+ for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++)
writel(g_map[i * 2 + 1] | (g_map[i * 2 + 2] << 16),
priv->io_base + _REG(data_port));
- for (i = 0; i < 20; i++)
+ for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++)
writel(b_map[i * 2] | (b_map[i * 2 + 1] << 16),
priv->io_base + _REG(data_port));
next prev parent reply other threads:[~2018-12-06 14:40 UTC|newest]
Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-06 14:38 [PATCH 4.19 00/41] 4.19.8-stable review Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 01/41] blk-mq: fix corruption with direct issue Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 02/41] test_hexdump: use memcpy instead of strncpy Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 03/41] unifdef: " Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 04/41] iser: set sector for ambiguous mr status errors Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 05/41] uprobes: Fix handle_swbp() vs. unregister() + register() race once more Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 06/41] mtd: nand: Fix memory allocation in nanddev_bbt_init() Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 07/41] arm64: ftrace: Fix to enable syscall events on arm64 Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 08/41] sched, trace: Fix prev_state output in sched_switch tracepoint Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 09/41] tracepoint: Use __idx instead of idx in DO_TRACE macro to make it unique Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 10/41] MIPS: ralink: Fix mt7620 nd_sd pinmux Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 11/41] mips: fix mips_get_syscall_arg o32 check Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 12/41] IB/mlx5: Avoid load failure due to unknown link width Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 13/41] tracing/fgraph: Fix set_graph_function from showing interrupts Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 14/41] drm/ast: Fix incorrect free on ioregs Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 15/41] drm/amd/dm: Dont forget to attach MST encoders Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 16/41] drm/amd/dm: Understand why attaching path/tile properties are needed Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 17/41] drm: set is_master to 0 upon drm_new_set_master() failure Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 18/41] drm/meson: Fixes for drm_crtc_vblank_on/off support Greg Kroah-Hartman
2018-12-06 14:38 ` [PATCH 4.19 19/41] drm/meson: Enable fast_io in meson_dw_hdmi_regmap_config Greg Kroah-Hartman
2018-12-06 14:39 ` Greg Kroah-Hartman [this message]
2018-12-06 14:39 ` [PATCH 4.19 21/41] userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 22/41] userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 23/41] userfaultfd: shmem: add i_size checks Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 24/41] userfaultfd: shmem: UFFDIO_COPY: set the page dirty if VM_WRITE is not set Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 25/41] kgdboc: Fix restrict error Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 26/41] kgdboc: Fix warning with module build Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 27/41] svm: Add mutex_lock to protect apic_access_page_done on AMD systems Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 28/41] selinux: add support for RTM_NEWCHAIN, RTM_DELCHAIN, and RTM_GETCHAIN Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 29/41] i40e: Fix deletion of MAC filters Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 30/41] scsi: lpfc: fix block guard enablement on SLI3 adapters Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 31/41] Input: xpad - quirk all PDP Xbox One gamepads Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 32/41] Input: synaptics - add PNP ID for ThinkPad P50 to SMBus Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 33/41] Input: matrix_keypad - check for errors from of_get_named_gpio() Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 34/41] Input: cros_ec_keyb - fix button/switch capability reports Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 35/41] Input: elan_i2c - add ELAN0620 to the ACPI table Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 36/41] Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 37/41] Input: elan_i2c - add support for ELAN0621 touchpad Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 38/41] btrfs: tree-checker: Dont check max block group size as current max chunk size limit is unreliable Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 39/41] ARC: change defconfig defaults to ARCv2 Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 40/41] arc: [devboards] Add support of NFSv3 ACL Greg Kroah-Hartman
2018-12-06 14:39 ` [PATCH 4.19 41/41] tipc: use destination length for copy string Greg Kroah-Hartman
2018-12-06 20:32 ` [PATCH 4.19 00/41] 4.19.8-stable review kernelci.org bot
2018-12-06 22:10 ` shuah
2018-12-07 6:52 ` Greg Kroah-Hartman
2018-12-07 8:28 ` Naresh Kamboju
2018-12-07 20:31 ` Guenter Roeck
2018-12-08 9:02 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181206142951.442912428@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=carlo@caione.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=khilman@baylibre.com \
--cc=linux-amlogic@lists.infradead.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lyude@redhat.com \
--cc=maxime.ripard@bootlin.com \
--cc=narmstrong@baylibre.com \
--cc=seanpaul@chromium.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).