leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
5bbf219328849e83878bddb7c226d8d42e84affc
linux/drivers/gpu/drm
History
Kees Cook 5bbf219328 drm/radeon: Fix off-by-one power_state index heap overwrite 
An out of bounds write happens when setting the default power state.
KASAN sees this as:

[drm] radeon: 512M of GTT memory ready.
[drm] GART: num cpu pages 131072, num gpu pages 131072
==================================================================
BUG: KASAN: slab-out-of-bounds in
radeon_atombios_parse_power_table_1_3+0x1837/0x1998 [radeon]
Write of size 4 at addr ffff88810178d858 by task systemd-udevd/157

CPU: 0 PID: 157 Comm: systemd-udevd Not tainted 5.12.0-E620 #50
Hardware name: eMachines        eMachines E620  /Nile       , BIOS V1.03 09/30/2008
Call Trace:
 dump_stack+0xa5/0xe6
 print_address_description.constprop.0+0x18/0x239
 kasan_report+0x170/0x1a8
 radeon_atombios_parse_power_table_1_3+0x1837/0x1998 [radeon]
 radeon_atombios_get_power_modes+0x144/0x1888 [radeon]
 radeon_pm_init+0x1019/0x1904 [radeon]
 rs690_init+0x76e/0x84a [radeon]
 radeon_device_init+0x1c1a/0x21e5 [radeon]
 radeon_driver_load_kms+0xf5/0x30b [radeon]
 drm_dev_register+0x255/0x4a0 [drm]
 radeon_pci_probe+0x246/0x2f6 [radeon]
 pci_device_probe+0x1aa/0x294
 really_probe+0x30e/0x850
 driver_probe_device+0xe6/0x135
 device_driver_attach+0xc1/0xf8
 __driver_attach+0x13f/0x146
 bus_for_each_dev+0xfa/0x146
 bus_add_driver+0x2b3/0x447
 driver_register+0x242/0x2c1
 do_one_initcall+0x149/0x2fd
 do_init_module+0x1ae/0x573
 load_module+0x4dee/0x5cca
 __do_sys_finit_module+0xf1/0x140
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Without KASAN, this will manifest later when the kernel attempts to
allocate memory that was stomped, since it collides with the inline slab
freelist pointer:

invalid opcode: 0000 [#1] SMP NOPTI
CPU: 0 PID: 781 Comm: openrc-run.sh Tainted: G        W 5.10.12-gentoo-E620 #2
Hardware name: eMachines        eMachines E620  /Nile , BIOS V1.03       09/30/2008
RIP: 0010:kfree+0x115/0x230
Code: 89 c5 e8 75 ea ff ff 48 8b 00 0f ba e0 09 72 63 e8 1f f4 ff ff 41 89 c4 48 8b 45 00 0f ba e0 10 72 0a 48 8b 45 08 a8 01 75 02 <0f> 0b 44 89 e1 48 c7 c2 00 f0 ff ff be 06 00 00 00 48 d3 e2 48 c7
RSP: 0018:ffffb42f40267e10 EFLAGS: 00010246
RAX: ffffd61280ee8d88 RBX: 0000000000000004 RCX: 000000008010000d
RDX: 4000000000000000 RSI: ffffffffba1360b0 RDI: ffffd61280ee8d80
RBP: ffffd61280ee8d80 R08: ffffffffb91bebdf R09: 0000000000000000
R10: ffff8fe2c1047ac8 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000100
FS:  00007fe80eff6b68(0000) GS:ffff8fe339c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe80eec7bc0 CR3: 0000000038012000 CR4: 00000000000006f0
Call Trace:
 __free_fdtable+0x16/0x1f
 put_files_struct+0x81/0x9b
 do_exit+0x433/0x94d
 do_group_exit+0xa6/0xa6
 __x64_sys_exit_group+0xf/0xf
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fe80ef64bea
Code: Unable to access opcode bytes at RIP 0x7fe80ef64bc0.
RSP: 002b:00007ffdb1c47528 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fe80ef64bea
RDX: 00007fe80ef64f60 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 00007fe80ee2c620 R11: 0000000000000246 R12: 00007fe80eff41e0
R13: 00000000ffffffff R14: 0000000000000024 R15: 00007fe80edf9cd0
Modules linked in: radeon(+) ath5k(+) snd_hda_codec_realtek ...

Use a valid power_state index when initializing the "flags" and "misc"
and "misc2" fields.

Bug: https://bugzilla.kernel.org/show_bug.cgi?id=211537
Reported-by: Erhard F. <erhard_f@mailbox.org>
Fixes: a48b9b4edb ("drm/radeon/kms/pm: add asic specific callbacks for getting power state (v2)")
Fixes: 79daedc942 ("drm/radeon/kms: minor pm cleanups")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2021-05-04 17:37:49 -04:00
..
amd
drm/amd/display: Fix two cursor duplication when using overlay
2021-05-04 17:35:52 -04:00
arm
drm/komeda: Fix bit check to import to value of proper type
2021-04-01 13:48:48 +01:00
armada
drm: Use state helper instead of the plane state pointer
2021-02-25 08:05:28 +01:00
aspeed
drm/gem: Move drm_gem_fb_prepare_fb() to GEM atomic helpers
2021-02-23 08:54:22 +01:00
ast
drm: Use state helper instead of the plane state pointer
2021-02-25 08:05:28 +01:00
atmel-hlcdc
drm: Use state helper instead of the plane state pointer
2021-02-25 08:05:28 +01:00
bochs
drm/bochs: Remove references to struct drm_device.pdev
2021-01-06 15:42:55 +01:00
bridge
Merge tag 'drm-misc-next-fixes-2021-04-22' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2021-04-23 13:53:07 +10:00
etnaviv
Merge drm/drm-fixes into drm-next
2021-04-13 23:15:09 +02:00
exynos
Merge drm/drm-fixes into drm-next
2021-04-13 23:15:09 +02:00
fsl-dcu
drm: Use state helper instead of the plane state pointer
2021-02-25 08:05:28 +01:00
gma500
gma500: Use DEFINE_SPINLOCK() for spinlock
2021-04-08 13:19:56 +02:00
gud
drm/gud: Remove unneeded semicolon
2021-03-23 10:32:14 +01:00
hisilicon
drm: Use state helper instead of the plane state pointer
2021-02-25 08:05:28 +01:00
i2c
…
i810
…
i915
Merge drm/drm-fixes into drm-next
2021-04-13 23:15:09 +02:00
imx
Merge drm/drm-fixes into drm-next
2021-04-13 23:15:09 +02:00
ingenic
drm/ingenic: Register devm action to cleanup encoders
2021-03-29 16:47:12 +01:00
kmb
drm: Use state helper instead of the plane state pointer
2021-02-25 08:05:28 +01:00
lib
…
lima
Revert "drm/scheduler: Job timeout handler returns status (v3)"
2021-02-10 15:26:00 +01:00
mcde
drm/mcde/panel: Inverse misunderstood flag
2021-03-04 14:31:06 +01:00
mediatek
Merge tag 'mediatek-drm-next-5.13' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-next
2021-04-08 12:42:14 +10:00
meson
drm/meson: Fix few typo
2021-03-19 10:40:54 +01:00
mga
drm/mga/mga_ioc32: Fix some formatting issues in 'mga_compat_ioctl's header
2021-01-18 15:41:12 +01:00
mgag200
drm/mgag200: Move vmap out of commit tail
2021-02-08 13:00:26 +01:00
msm
Merge tag 'drm-msm-next-2021-04-11' of https://gitlab.freedesktop.org/drm/msm into drm-next
2021-04-13 23:35:54 +02:00
mxsfb
drm: Use state helper instead of the plane state pointer
2021-02-25 08:05:28 +01:00
nouveau
Merge drm/drm-fixes into drm-next
2021-04-13 23:15:09 +02:00
omapdrm
Merge drm/drm-fixes into drm-next
2021-04-13 23:15:09 +02:00
panel
Merge drm/drm-fixes into drm-next
2021-04-13 23:15:09 +02:00
panfrost
drm/panfrost: Stay in the threaded MMU IRQ handler until we've handled all IRQs
2021-02-15 09:43:33 +01:00
pl111
Merge tag 'drm-misc-next-2021-03-03' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2021-03-16 17:08:46 +10:00
qxl
drm/ttm: switch to per device LRU lock
2021-03-24 17:05:25 +01:00
r128
drm/r128/r128_ioc32: Fix formatting issues in 'r128_compat_ioctl()'s header
2021-01-18 15:41:04 +01:00
radeon
drm/radeon: Fix off-by-one power_state index heap overwrite
2021-05-04 17:37:49 -04:00
rcar-du
Merge drm/drm-fixes into drm-next
2021-04-13 23:15:09 +02:00
rockchip
drm/rockchip: Remove unused variable
2021-03-24 09:31:22 +01:00
savage
drm/savage/savage_bci: Remove set but never used 'aper_rsrc' and 'fb_rsrc'
2020-11-12 20:31:01 +01:00
scheduler
drm/amd/amdgpu implement tdr advanced mode
2021-04-09 16:45:45 -04:00
selftests
drm/selftests/test-drm_dp_mst_helper: Move 'sideband_msg_req_encode_decode' onto the heap
2020-11-17 20:08:29 +01:00
shmobile
drm/<drivers>: Constify struct drm_driver
2020-11-06 10:31:26 +01:00
sis
…
sti
drm: Use state helper instead of the plane state pointer
2021-02-25 08:05:28 +01:00
stm
drm/stm: dsi: Avoid printing errors for -EPROBE_DEFER
2021-03-08 15:06:56 +01:00
sun4i
Merge tag 'drm-misc-next-2021-03-03' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2021-03-16 17:08:46 +10:00
tdfx
drm: Constify drm_driver in drivers that don't modify it
2021-01-05 07:20:36 +02:00
tegra
Merge drm/drm-fixes into drm-next
2021-04-13 23:15:09 +02:00
tidss
drm: Use state helper instead of the plane state pointer
2021-02-25 08:05:28 +01:00
tilcdc
drm/tilcdc: fix pixel clock setting warning message
2021-03-24 12:05:28 +02:00
tiny
Merge tag 'drm-misc-next-2021-03-03' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2021-03-16 17:08:46 +10:00
ttm
Merge tag 'drm-misc-next-fixes-2021-04-22' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2021-04-23 13:53:07 +10:00
tve200
drm/gem: Move drm_gem_fb_prepare_fb() to GEM atomic helpers
2021-02-23 08:54:22 +01:00
udl
Merge tag 'drm-misc-next-2021-03-03' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2021-03-16 17:08:46 +10:00
v3d
Revert "drm/scheduler: Job timeout handler returns status (v3)"
2021-02-10 15:26:00 +01:00
vboxvideo
drm/vboxvideo: Use managed VRAM-helper initialization
2021-03-11 14:19:43 +01:00
vc4
Merge drm/drm-fixes into drm-next
2021-04-13 23:15:09 +02:00
vgem
drm/prime: split array import functions v4
2020-11-30 15:00:45 +01:00
via
via/via_irq: use __func__ to replace string function name
2020-11-27 16:14:02 +01:00
virtio
drm/virtio: fix possible leak/unlock virtio_gpu_object_array
2021-03-09 12:06:18 +01:00
vkms
drm/vkms: fix misuse of WARN_ON
2021-03-25 08:23:28 -03:00
vmwgfx
drm/ttm: remove swap LRU v3
2021-03-24 17:05:14 +01:00
xen
Merge drm/drm-fixes into drm-next
2021-04-13 23:15:09 +02:00
xlnx
drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train()
2021-04-08 12:52:10 +02:00
zte
drm: Use state helper instead of the plane state pointer
2021-02-25 08:05:28 +01:00
drm_agpsupport.c
drm: Upcast struct drm_device.dev to struct pci_device; replace pdev
2021-01-19 09:06:38 +01:00
drm_atomic_helper.c
drm: Fix 3 typos in the inline doc
2021-03-26 11:46:33 +01:00
drm_atomic_state_helper.c
drm: fix some kernel-doc markups
2020-11-16 20:48:20 +01:00
drm_atomic_uapi.c
drm: fix oops in drm_atomic_set_crtc_for_connector
2020-11-16 09:56:55 +01:00
drm_atomic.c
drm/atomic: Couple of typo fixes
2021-04-09 16:42:09 -04:00
drm_auth.c
…
drm_blend.c
drm/doc: introduce new section for standard plane properties
2020-12-17 16:56:40 +01:00
drm_bridge_connector.c
gpu/drm: delete same check in if condition
2020-11-02 14:04:53 +01:00
drm_bridge.c
…
drm_bufs.c
drm: Upcast struct drm_device.dev to struct pci_device; replace pdev
2021-01-19 09:06:38 +01:00
drm_cache.c
drm: Include <linux/mem_encrypt.h> in drm_cache.c
2021-01-14 09:42:31 +01:00
drm_client_modeset.c
drm: replace drm_modeset_lock_all() in drm_client_modeset_dpms_legacy()
2021-02-09 17:16:57 +01:00
drm_client.c
drm/client: Depend on GEM object kmap ref-counting
2020-11-24 09:27:54 +01:00
drm_color_mgmt.c
drm: add legacy support for using degamma for gamma
2020-12-15 15:46:03 +02:00
drm_connector.c
drm/uapi: Add USB connector type
2021-03-16 12:45:28 +01:00
drm_context.c
…
drm_crtc_helper_internal.h
drm: remove drm_fb_helper_modinit
2021-02-08 12:20:38 +01:00
drm_crtc_helper.c
…
drm_crtc_internal.h
drm: Introduce plane and CRTC scaling filter properties
2020-10-21 12:19:54 +03:00
drm_crtc.c
drm: Switch to %p4cc format modifier
2021-02-17 12:52:59 +01:00
drm_damage_helper.c
…
drm_debugfs_crc.c
…
drm_debugfs.c
…
drm_displayid.c
drm/displayid: rename displayid_hdr to displayid_header
2021-03-31 15:42:39 +03:00
drm_dma.c
…
drm_dp_aux_dev.c
drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
2020-10-15 13:58:54 -04:00
drm_dp_cec.c
…
drm_dp_dual_mode_helper.c
…
drm_dp_helper.c
drm/dp_helper: Define options for FRL training for HDMI2.1 PCON
2021-03-31 12:21:06 +03:00
drm_dp_mst_topology_internal.h
…
drm_dp_mst_topology.c
drm/dp_mst: Drop DRM_ERROR() on kzalloc() fail in drm_dp_mst_handle_up_req()
2021-04-08 17:47:26 -04:00
drm_drv.c
drm/drv: Remove initialization of static variables
2021-02-21 19:49:17 -05:00
drm_dsc.c
drm/dsc: add helper for calculating rc buffer size from DPCD
2020-12-10 10:49:47 +02:00
drm_dumb_buffers.c
drm: Don't export the drm_gem_dumb_destroy() function
2021-01-05 07:20:25 +02:00
drm_edid_load.c
…
drm_edid.c
drm/edid: use the new displayid iterator for tile info
2021-03-31 15:42:02 +03:00
drm_encoder_slave.c
…
drm_encoder.c
drm: add drmm_encoder_alloc()
2021-01-04 12:59:33 +01:00
drm_fb_cma_helper.c
…
drm_fb_helper.c
drm/fb-helper: only unmap if buffer not null
2021-03-11 11:08:14 +01:00
drm_file.c
drm/drm_vblank: set the dma-fence timestamp during send_vblank_event
2021-02-24 21:05:54 +05:30
drm_flip_work.c
…
drm_format_helper.c
…
drm_fourcc.c
drm/fourcc: Add AXBXGXRX106106106106 format
2020-10-20 20:51:42 +01:00
drm_framebuffer.c
drm: Switch to %p4cc format modifier
2021-02-17 12:52:59 +01:00
drm_gem_atomic_helper.c
drm/gem: Move drm_gem_fb_prepare_fb() to GEM atomic helpers
2021-02-23 08:54:22 +01:00
drm_gem_cma_helper.c
drm/cma-helper: Implement mmap as GEM CMA object functions
2020-11-30 13:38:27 +01:00
drm_gem_framebuffer_helper.c
drm/gem: Move drm_gem_fb_prepare_fb() to GEM atomic helpers
2021-02-23 08:54:22 +01:00
drm_gem_shmem_helper.c
drm/shmem-helpers: vunmap: Don't put pages for dma-buf
2021-03-11 11:11:33 +01:00
drm_gem_ttm_helper.c
drm/ttm: Add vmap/vunmap to TTM and TTM GEM helpers
2020-11-09 09:17:36 +01:00
drm_gem_vram_helper.c
Merge tag 'drm-misc-next-2021-03-03' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2021-03-16 17:08:46 +10:00
drm_gem.c
drm/gem: Export drm_gem_vmap() and drm_gem_vunmap()
2021-02-08 13:00:06 +01:00
drm_hashtab.c
…
drm_hdcp.c
…
drm_internal.h
drm/drm_internal.h: Remove repeated struct declaration
2021-04-08 13:05:38 +02:00
drm_ioc32.c
drm/compat: Clear bounce structures
2021-03-11 11:11:33 +01:00
drm_ioctl.c
drm: Give irq_by_busid drm_legacy_ prefix
2020-10-21 18:05:11 +02:00
drm_irq.c
drm: Upcast struct drm_device.dev to struct pci_device; replace pdev
2021-01-19 09:06:38 +01:00
drm_kms_helper_common.c
drm: remove drm_fb_helper_modinit
2021-02-08 12:20:38 +01:00
drm_lease.c
…
drm_legacy_misc.c
…
drm_legacy.h
drm: Merge CONFIG_DRM_VM into CONFIG_DRM_LEGACY
2021-01-13 14:22:37 +01:00
drm_lock.c
…
drm_managed.c
drm/dev: Remove drm_dev_init
2020-09-21 10:45:08 +02:00
drm_memory.c
drm: Implement drm_need_swiotlb() in drm_cache.c
2021-01-13 14:22:29 +01:00
drm_mipi_dbi.c
drm: Switch to %p4cc format modifier
2021-02-17 12:52:59 +01:00
drm_mipi_dsi.c
…
drm_mm.c
…
drm_mode_config.c
Merge tag 'drm-misc-next-2021-01-06' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2021-01-07 13:40:20 +01:00
drm_mode_object.c
drm: fix some kernel-doc markups
2020-11-16 20:48:20 +01:00
drm_modes.c
drm: Refuse to create zero width/height cmdline modes
2021-04-01 20:29:16 +03:00
drm_modeset_helper.c
…
drm_modeset_lock.c
…
drm_of.c
…
drm_panel_orientation_quirks.c
drm: Added orientation quirk for OneGX1 Pro
2021-01-20 22:33:01 +01:00
drm_panel.c
…
drm_pci.c
drm: Upcast struct drm_device.dev to struct pci_device; replace pdev
2021-01-19 09:06:38 +01:00
drm_plane_helper.c
…
drm_plane.c
Merge tag 'drm-misc-next-2021-03-03' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2021-03-16 17:08:46 +10:00
drm_prime.c
drm: Set vm_ops to GEM object's values during mmap
2021-01-18 10:37:26 +01:00
drm_print.c
…
drm_probe_helper.c
drm/probe-helper: Check epoch counter in output_poll_execute()
2021-03-16 12:45:52 +01:00
drm_property.c
drm: Few typo fixes
2021-03-18 14:22:50 +01:00
drm_rect.c
…
drm_scatter.c
…
drm_scdc_helper.c
drm: fix some kernel-doc markups
2020-11-16 20:48:20 +01:00
drm_self_refresh_helper.c
…
drm_simple_kms_helper.c
drm/atomic: Pass the full state to planes atomic disable and update
2021-02-25 08:05:28 +01:00
drm_syncobj.c
drm/syncobj: use newly allocated stub fences
2021-04-08 12:21:13 +02:00
drm_sysfs.c
drm/sysfs: Convert sysfs sprintf/snprintf family to sysfs_emit
2021-03-23 07:41:39 -04:00
drm_trace_points.c
…
drm_trace.h
…
drm_vblank_work.c
…
drm_vblank.c
drm/vblank: Do not store a new vblank timestamp in drm_vblank_restore()
2021-04-01 20:29:17 +03:00
drm_vm.c
drm: Upcast struct drm_device.dev to struct pci_device; replace pdev
2021-01-19 09:06:38 +01:00
drm_vma_manager.c
…
drm_writeback.c
…
Kconfig
drm/radeon: fix AGP dependency
2021-03-23 23:25:21 -04:00
Makefile
drm/displayid: add separate drm_displayid.c
2021-03-31 15:41:35 +03:00