1. 19 11月, 2020 1 次提交
  2. 18 11月, 2020 2 次提交
  3. 13 11月, 2020 1 次提交
  4. 11 11月, 2020 1 次提交
  5. 09 11月, 2020 1 次提交
    • T
      drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] · 06ad8d33
      Thomas Zimmermann 提交于
      The gma500 driver expects 3 pipelines in several it's IRQ functions.
      Accessing struct drm_device.vblank[], this fails with devices that only
      have 2 pipelines. An example KASAN report is shown below.
      
        [   62.267688] ==================================================================
        [   62.268856] BUG: KASAN: slab-out-of-bounds in psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
        [   62.269450] Read of size 1 at addr ffff8880012bc6d0 by task systemd-udevd/285
        [   62.269949]
        [   62.270192] CPU: 0 PID: 285 Comm: systemd-udevd Tainted: G            E     5.10.0-rc1-1-default+ #572
        [   62.270807] Hardware name:  /DN2800MT, BIOS MTCDT10N.86A.0164.2012.1213.1024 12/13/2012
        [   62.271366] Call Trace:
        [   62.271705]  dump_stack+0xae/0xe5
        [   62.272180]  print_address_description.constprop.0+0x17/0xf0
        [   62.272987]  ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
        [   62.273474]  __kasan_report.cold+0x20/0x38
        [   62.273989]  ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
        [   62.274460]  kasan_report+0x3a/0x50
        [   62.274891]  psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
        [   62.275380]  drm_irq_install+0x131/0x1f0
        <...>
        [   62.300751] Allocated by task 285:
        [   62.301223]  kasan_save_stack+0x1b/0x40
        [   62.301731]  __kasan_kmalloc.constprop.0+0xbf/0xd0
        [   62.302293]  drmm_kmalloc+0x55/0x100
        [   62.302773]  drm_vblank_init+0x77/0x210
      
      Resolve the issue by only handling vblank entries up to the number of
      CRTCs.
      
      I'm adding a Fixes tag for reference, although the bug has been present
      since the driver's initial commit.
      Signed-off-by: NThomas Zimmermann <tzimmermann@suse.de>
      Reviewed-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      Fixes: 5c49fd3a ("gma500: Add the core DRM files and headers")
      Cc: Alan Cox <alan@linux.intel.com>
      Cc: Dave Airlie <airlied@redhat.com>
      Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
      Cc: dri-devel@lists.freedesktop.org
      Cc: stable@vger.kernel.org#v3.3+
      Link: https://patchwork.freedesktop.org/patch/msgid/20201105190256.3893-1-tzimmermann@suse.de
      06ad8d33
  6. 08 11月, 2020 1 次提交
  7. 03 11月, 2020 3 次提交
  8. 02 11月, 2020 6 次提交
  9. 30 10月, 2020 9 次提交
  10. 29 10月, 2020 2 次提交
  11. 28 10月, 2020 5 次提交
  12. 27 10月, 2020 8 次提交