Patch "drm/fbdev-generic: prohibit potential out-of-bounds access" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    drm/fbdev-generic: prohibit potential out-of-bounds access

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-fbdev-generic-prohibit-potential-out-of-bounds-a.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 14dccc71ad925d19d87d3d7a117315c108cd9f57
Author: Sui Jingfeng <suijingfeng@xxxxxxxxxxx>
Date:   Thu Apr 20 11:05:00 2023 +0800

    drm/fbdev-generic: prohibit potential out-of-bounds access
    
    [ Upstream commit c8687694bb1f5c48134f152f8c5c2e53483eb99d ]
    
    The fbdev test of IGT may write after EOF, which lead to out-of-bound
    access for drm drivers with fbdev-generic. For example, run fbdev test
    on a x86+ast2400 platform, with 1680x1050 resolution, will cause the
    linux kernel hang with the following call trace:
    
      Oops: 0000 [#1] PREEMPT SMP PTI
      [IGT] fbdev: starting subtest eof
      Workqueue: events drm_fb_helper_damage_work [drm_kms_helper]
      [IGT] fbdev: starting subtest nullptr
    
      RIP: 0010:memcpy_erms+0xa/0x20
      RSP: 0018:ffffa17d40167d98 EFLAGS: 00010246
      RAX: ffffa17d4eb7fa80 RBX: ffffa17d40e0aa80 RCX: 00000000000014c0
      RDX: 0000000000001a40 RSI: ffffa17d40e0b000 RDI: ffffa17d4eb80000
      RBP: ffffa17d40167e20 R08: 0000000000000000 R09: ffff89522ecff8c0
      R10: ffffa17d4e4c5000 R11: 0000000000000000 R12: ffffa17d4eb7fa80
      R13: 0000000000001a40 R14: 000000000000041a R15: ffffa17d40167e30
      FS:  0000000000000000(0000) GS:ffff895257380000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: ffffa17d40e0b000 CR3: 00000001eaeca006 CR4: 00000000001706e0
      Call Trace:
       <TASK>
       ? drm_fbdev_generic_helper_fb_dirty+0x207/0x330 [drm_kms_helper]
       drm_fb_helper_damage_work+0x8f/0x170 [drm_kms_helper]
       process_one_work+0x21f/0x430
       worker_thread+0x4e/0x3c0
       ? __pfx_worker_thread+0x10/0x10
       kthread+0xf4/0x120
       ? __pfx_kthread+0x10/0x10
       ret_from_fork+0x2c/0x50
       </TASK>
      CR2: ffffa17d40e0b000
      ---[ end trace 0000000000000000 ]---
    
    The is because damage rectangles computed by
    drm_fb_helper_memory_range_to_clip() function is not guaranteed to be
    bound in the screen's active display area. Possible reasons are:
    
    1) Buffers are allocated in the granularity of page size, for mmap system
       call support. The shadow screen buffer consumed by fbdev emulation may
       also choosed be page size aligned.
    
    2) The DIV_ROUND_UP() used in drm_fb_helper_memory_range_to_clip()
       will introduce off-by-one error.
    
    For example, on a 16KB page size system, in order to store a 1920x1080
    XRGB framebuffer, we need allocate 507 pages. Unfortunately, the size
    1920*1080*4 can not be divided exactly by 16KB.
    
     1920 * 1080 * 4 = 8294400 bytes
     506 * 16 * 1024 = 8290304 bytes
     507 * 16 * 1024 = 8306688 bytes
    
     line_length = 1920*4 = 7680 bytes
    
     507 * 16 * 1024 / 7680 = 1081.6
    
     off / line_length = 507 * 16 * 1024 / 7680 = 1081
     DIV_ROUND_UP(507 * 16 * 1024, 7680) will yeild 1082
    
    memcpy_toio() typically issue the copy line by line, when copy the last
    line, out-of-bound access will be happen. Because:
    
     1082 * line_length = 1082 * 7680 = 8309760, and 8309760 > 8306688
    
    Note that userspace may still write to the invisiable area if a larger
    buffer than width x stride is exposed. But it is not a big issue as
    long as there still have memory resolve the access if not drafting so
    far.
    
     - Also limit the y1 (Daniel)
     - keep fix patch it to minimal (Daniel)
     - screen_size is page size aligned because of it need mmap (Thomas)
     - Adding fixes tag (Thomas)
    
    Signed-off-by: Sui Jingfeng <suijingfeng@xxxxxxxxxxx>
    Fixes: aa15c677cc34 ("drm/fb-helper: Fix vertical damage clipping")
    Reviewed-by: Thomas Zimmermann <tzimmermann@xxxxxxx>
    Tested-by: Geert Uytterhoeven <geert+renesas@xxxxxxxxx>
    Link: https://lore.kernel.org/dri-devel/ad44df29-3241-0d9e-e708-b0338bf3c623@xxxxxx/
    Signed-off-by: Thomas Zimmermann <tzimmermann@xxxxxxx>
    Link: https://patchwork.freedesktop.org/patch/msgid/20230420030500.1578756-1-suijingfeng@xxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 06cd2f8c27734..76e46713b2f0c 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -708,19 +708,27 @@ static void drm_fb_helper_damage(struct fb_info *info, u32 x, u32 y,
 static void drm_fb_helper_memory_range_to_clip(struct fb_info *info, off_t off, size_t len,
 					       struct drm_rect *clip)
 {
+	u32 line_length = info->fix.line_length;
+	u32 fb_height = info->var.yres;
 	off_t end = off + len;
 	u32 x1 = 0;
-	u32 y1 = off / info->fix.line_length;
+	u32 y1 = off / line_length;
 	u32 x2 = info->var.xres;
-	u32 y2 = DIV_ROUND_UP(end, info->fix.line_length);
+	u32 y2 = DIV_ROUND_UP(end, line_length);
+
+	/* Don't allow any of them beyond the bottom bound of display area */
+	if (y1 > fb_height)
+		y1 = fb_height;
+	if (y2 > fb_height)
+		y2 = fb_height;
 
 	if ((y2 - y1) == 1) {
 		/*
 		 * We've only written to a single scanline. Try to reduce
 		 * the number of horizontal pixels that need an update.
 		 */
-		off_t bit_off = (off % info->fix.line_length) * 8;
-		off_t bit_end = (end % info->fix.line_length) * 8;
+		off_t bit_off = (off % line_length) * 8;
+		off_t bit_end = (end % line_length) * 8;
 
 		x1 = bit_off / info->var.bits_per_pixel;
 		x2 = DIV_ROUND_UP(bit_end, info->var.bits_per_pixel);



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux