dri-devel July 2020

dri-devel@lists.freedesktop.org

336 participants
772 discussions

[Linux-kernel-mentees] [PATCH] drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
by Peilin Ye 31 Jul '20

31 Jul '20

Compiler leaves a 4-byte hole near the end of `dev_info`, causing amdgpu_info_ioctl() to copy uninitialized kernel stack memory to userspace when `size` is greater than 356. In 2015 we tried to fix this issue by doing `= {};` on `dev_info`, which unfortunately does not initialize that 4-byte hole. Fix it by using memset() instead. Cc: stable(a)vger.kernel.org Fixes: c193fa91b918 ("drm/amdgpu: information leak in amdgpu_info_ioctl()") Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") Suggested-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Peilin Ye <yepeilin.cs(a)gmail.com> --- $ pahole -C "drm_amdgpu_info_device" drivers/gpu/drm/amd/amdgpu/amdgpu_kms.o struct drm_amdgpu_info_device { __u32 device_id; /* 0 4 */ __u32 chip_rev; /* 4 4 */ __u32 external_rev; /* 8 4 */ __u32 pci_rev; /* 12 4 */ __u32 family; /* 16 4 */ __u32 num_shader_engines; /* 20 4 */ __u32 num_shader_arrays_per_engine; /* 24 4 */ __u32 gpu_counter_freq; /* 28 4 */ __u64 max_engine_clock; /* 32 8 */ __u64 max_memory_clock; /* 40 8 */ __u32 cu_active_number; /* 48 4 */ __u32 cu_ao_mask; /* 52 4 */ __u32 cu_bitmap[4][4]; /* 56 64 */ /* --- cacheline 1 boundary (64 bytes) was 56 bytes ago --- */ __u32 enabled_rb_pipes_mask; /* 120 4 */ __u32 num_rb_pipes; /* 124 4 */ /* --- cacheline 2 boundary (128 bytes) --- */ __u32 num_hw_gfx_contexts; /* 128 4 */ __u32 _pad; /* 132 4 */ __u64 ids_flags; /* 136 8 */ __u64 virtual_address_offset; /* 144 8 */ __u64 virtual_address_max; /* 152 8 */ __u32 virtual_address_alignment; /* 160 4 */ __u32 pte_fragment_size; /* 164 4 */ __u32 gart_page_size; /* 168 4 */ __u32 ce_ram_size; /* 172 4 */ __u32 vram_type; /* 176 4 */ __u32 vram_bit_width; /* 180 4 */ __u32 vce_harvest_config; /* 184 4 */ __u32 gc_double_offchip_lds_buf; /* 188 4 */ /* --- cacheline 3 boundary (192 bytes) --- */ __u64 prim_buf_gpu_addr; /* 192 8 */ __u64 pos_buf_gpu_addr; /* 200 8 */ __u64 cntl_sb_buf_gpu_addr; /* 208 8 */ __u64 param_buf_gpu_addr; /* 216 8 */ __u32 prim_buf_size; /* 224 4 */ __u32 pos_buf_size; /* 228 4 */ __u32 cntl_sb_buf_size; /* 232 4 */ __u32 param_buf_size; /* 236 4 */ __u32 wave_front_size; /* 240 4 */ __u32 num_shader_visible_vgprs; /* 244 4 */ __u32 num_cu_per_sh; /* 248 4 */ __u32 num_tcc_blocks; /* 252 4 */ /* --- cacheline 4 boundary (256 bytes) --- */ __u32 gs_vgt_table_depth; /* 256 4 */ __u32 gs_prim_buffer_depth; /* 260 4 */ __u32 max_gs_waves_per_vgt; /* 264 4 */ __u32 _pad1; /* 268 4 */ __u32 cu_ao_bitmap[4][4]; /* 272 64 */ /* --- cacheline 5 boundary (320 bytes) was 16 bytes ago --- */ __u64 high_va_offset; /* 336 8 */ __u64 high_va_max; /* 344 8 */ __u32 pa_sc_tile_steering_override; /* 352 4 */ /* XXX 4 bytes hole, try to pack */ __u64 tcc_disabled_mask; /* 360 8 */ /* size: 368, cachelines: 6, members: 49 */ /* sum members: 364, holes: 1, sum holes: 4 */ /* last cacheline: 48 bytes */ }; drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c index a8c47aecd342..0047da06041f 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c @@ -707,9 +707,10 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file return n ? -EFAULT : 0; } case AMDGPU_INFO_DEV_INFO: { - struct drm_amdgpu_info_device dev_info = {}; + struct drm_amdgpu_info_device dev_info; uint64_t vm_size; + memset(&dev_info, 0, sizeof(dev_info)); dev_info.device_id = dev->pdev->device; dev_info.chip_rev = adev->rev_id; dev_info.external_rev = adev->external_rev_id; -- 2.25.1

8 10

[PATCH drm/hisilicon 2/2] drm/hisilicon: Code refactoring for hibmc_drv_de
by Tian Tao 31 Jul '20

31 Jul '20

code refactoring for hibmc_drv_de.c, no actual function changes. Signed-off-by: Tian Tao <tiantao6(a)hisilicon.com> --- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 55 ++++++------------------- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 2 + 2 files changed, 15 insertions(+), 42 deletions(-) diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c index 66132eb..af24c72 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c @@ -157,37 +157,6 @@ static const struct drm_plane_helper_funcs hibmc_plane_helper_funcs = { .atomic_update = hibmc_plane_atomic_update, }; -static struct drm_plane *hibmc_plane_init(struct hibmc_drm_private *priv) -{ - struct drm_device *dev = priv->dev; - struct drm_plane *plane; - int ret = 0; - - plane = devm_kzalloc(dev->dev, sizeof(*plane), GFP_KERNEL); - if (!plane) { - DRM_ERROR("failed to alloc memory when init plane\n"); - return ERR_PTR(-ENOMEM); - } - /* - * plane init - * TODO: Now only support primary plane, overlay planes - * need to do. - */ - ret = drm_universal_plane_init(dev, plane, 1, &hibmc_plane_funcs, - channel_formats1, - ARRAY_SIZE(channel_formats1), - NULL, - DRM_PLANE_TYPE_PRIMARY, - NULL); - if (ret) { - DRM_ERROR("failed to init plane: %d\n", ret); - return ERR_PTR(ret); - } - - drm_plane_helper_add(plane, &hibmc_plane_helper_funcs); - return plane; -} - static void hibmc_crtc_dpms(struct drm_crtc *crtc, int dpms) { struct hibmc_drm_private *priv = crtc->dev->dev_private; @@ -534,22 +503,24 @@ static const struct drm_crtc_helper_funcs hibmc_crtc_helper_funcs = { int hibmc_de_init(struct hibmc_drm_private *priv) { struct drm_device *dev = priv->dev; - struct drm_crtc *crtc; - struct drm_plane *plane; + struct drm_crtc *crtc = &priv->crtc; + struct drm_plane *plane = &priv->plane; int ret; - plane = hibmc_plane_init(priv); - if (IS_ERR(plane)) { - DRM_ERROR("failed to create plane: %ld\n", PTR_ERR(plane)); - return PTR_ERR(plane); - } + ret = drm_universal_plane_init(dev, plane, 1, &hibmc_plane_funcs, + channel_formats1, + ARRAY_SIZE(channel_formats1), + NULL, + DRM_PLANE_TYPE_PRIMARY, + NULL); - crtc = devm_kzalloc(dev->dev, sizeof(*crtc), GFP_KERNEL); - if (!crtc) { - DRM_ERROR("failed to alloc memory when init crtc\n"); - return -ENOMEM; + if (ret) { + DRM_ERROR("failed to init plane: %d\n", ret); + return ret; } + drm_plane_helper_add(plane, &hibmc_plane_helper_funcs); + ret = drm_crtc_init_with_planes(dev, crtc, plane, NULL, &hibmc_crtc_funcs, NULL); if (ret) { diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h index a683763..91ef15c 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h @@ -28,6 +28,8 @@ struct hibmc_drm_private { /* drm */ struct drm_device *dev; + struct drm_plane plane; + struct drm_crtc crtc; struct drm_encoder encoder; struct drm_connector connector; bool mode_config_initialized; -- 2.7.4

2 1

[PATCH drm/hisilicon 1/2] drm/hisilicon: Remove the unnecessary header files
by Tian Tao 31 Jul '20

31 Jul '20

Remove some unused header files. Signed-off-by: Tian Tao <tiantao6(a)hisilicon.com> --- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 3 --- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 5 ----- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 2 -- 3 files changed, 10 deletions(-) diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c index cc70e83..66132eb 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c @@ -17,9 +17,6 @@ #include <drm/drm_atomic_helper.h> #include <drm/drm_fourcc.h> #include <drm/drm_gem_vram_helper.h> -#include <drm/drm_plane_helper.h> -#include <drm/drm_print.h> -#include <drm/drm_probe_helper.h> #include <drm/drm_vblank.h> #include "hibmc_drm_drv.h" diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c index b8d839a..54f6144 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c @@ -11,18 +11,13 @@ * Jianhua Li <lijianhua(a)huawei.com> */ -#include <linux/console.h> -#include <linux/module.h> #include <linux/pci.h> #include <drm/drm_atomic_helper.h> #include <drm/drm_drv.h> -#include <drm/drm_fb_helper.h> #include <drm/drm_gem_vram_helper.h> #include <drm/drm_irq.h> #include <drm/drm_managed.h> -#include <drm/drm_print.h> -#include <drm/drm_probe_helper.h> #include <drm/drm_vblank.h> #include "hibmc_drm_drv.h" diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c index 2ca69c3..ed12f61 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c @@ -11,10 +11,8 @@ * Jianhua Li <lijianhua(a)huawei.com> */ -#include <drm/drm_gem_vram_helper.h> #include <drm/drm_atomic_helper.h> #include <drm/drm_probe_helper.h> -#include <drm/drm_crtc_helper.h> #include <drm/drm_print.h> #include "hibmc_drm_drv.h" -- 2.7.4

2 1

oops in drm-next on vmwgfx
by Dave Airlie 31 Jul '20

31 Jul '20

I booted up drm-next to test my ttm rework, but hey drm-next oops on startup without it. Probably need to get that fixed, haven't bisected yet. Dave. [ 2.689057] [drm] DMA map mode: Caching DMA mappings. [ 2.689151] [drm] Capabilities: [ 2.689151] [drm] Rect copy. [ 2.689151] [drm] Cursor. [ 2.689152] [drm] Cursor bypass. [ 2.689152] [drm] Cursor bypass 2. [ 2.689152] [drm] 8bit emulation. [ 2.689152] [drm] Alpha cursor. [ 2.689152] [drm] 3D. [ 2.689152] [drm] Extended Fifo. [ 2.689152] [drm] Multimon. [ 2.689153] [drm] Pitchlock. [ 2.689153] [drm] Irq mask. [ 2.689153] [drm] Display Topology. [ 2.689153] [drm] GMR. [ 2.689153] [drm] Traces. [ 2.689153] [drm] GMR2. [ 2.689153] [drm] Screen Object 2. [ 2.689154] [drm] Command Buffers. [ 2.689154] [drm] Command Buffers 2. [ 2.689154] [drm] Guest Backed Resources. [ 2.689154] [drm] DX Features. [ 2.689154] [drm] HP Command Queue. [ 2.689154] [drm] Capabilities2: [ 2.689154] [drm] Grow oTable. [ 2.689154] [drm] IntraSurface copy. [ 2.689155] [drm] Max GMR ids is 64 [ 2.689155] [drm] Max number of GMR pages is 65536 [ 2.689156] [drm] Max dedicated hypervisor surface memory is 0 kiB [ 2.689156] [drm] Maximum display memory size is 262144 kiB [ 2.689156] [drm] VRAM at 0xe8000000 size is 131072 kiB [ 2.689157] [drm] MMIO at 0xfe000000 size is 256 kiB [ 2.706367] [TTM] Zone kernel: Available graphics memory: 1001350 KiB [ 2.706368] [TTM] Initializing pool allocator [ 2.706371] [TTM] Initializing DMA pool allocator [ 2.776377] BUG: kernel NULL pointer dereference, address: 0000000000000190 [ 2.776491] #PF: supervisor read access in kernel mode [ 2.776537] #PF: error_code(0x0000) - not-present page [ 2.776583] PGD 0 P4D 0 [ 2.776612] Oops: 0000 [#1] SMP NOPTI [ 2.776649] CPU: 0 PID: 333 Comm: systemd-udevd Not tainted 5.8.0-rc6+ #3 [ 2.776707] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019 [ 2.776804] RIP: 0010:drm_dev_has_vblank+0x5/0x20 [drm] [ 2.776852] Code: d0 0f 85 18 ff ff ff e9 2f ff ff ff 89 f1 89 e8 45 31 ff d3 e0 89 c1 e9 fa fe ff ff 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 <8b> 87 90 01 00 00 85 c0 0f 95 c0 c3 66 66 2e 0f 1f 84 00 00 00 00 [ 2.776995] RSP: 0000:ffffa9904078fb08 EFLAGS: 00010286 [ 2.777042] RAX: ffff8f0af2f02e00 RBX: ffff8f0af1ce3000 RCX: 0000000000000000 [ 2.777102] RDX: 0000000000000000 RSI: ffff8f0af2f02e00 RDI: 0000000000000000 [ 2.777162] RBP: ffff8f0af2f02e00 R08: ffff8f0b3be2f140 R09: 0000000000000000 [ 2.777223] R10: ffff8f0af2f02e00 R11: 3432524134325258 R12: 0000000000000000 [ 2.777283] R13: ffff8f0af1ce7000 R14: ffff8f0af1ce3000 R15: 0000000000000000 [ 2.777423] FS: 00007f2029cd0b80(0000) GS:ffff8f0b3be00000(0000) knlGS:0000000000000000 [ 2.777491] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2.777542] CR2: 0000000000000190 CR3: 0000000032c76003 CR4: 00000000003606f0 [ 2.777615] Call Trace: [ 2.777650] __drm_atomic_helper_crtc_reset+0x1e/0x40 [drm_kms_helper] [ 2.777716] vmw_kms_stdu_init_display+0x19a/0x380 [vmwgfx] [ 2.777790] vmw_kms_init+0x6e/0xc0 [vmwgfx] [ 2.777848] vmw_probe.cold+0xb58/0xd89 [vmwgfx] [ 2.777908] local_pci_probe+0x42/0x80 [ 2.777954] ? _cond_resched+0x16/0x40 [ 2.777998] pci_device_probe+0xd9/0x190 [ 2.778045] really_probe+0x167/0x410 [ 2.778089] driver_probe_device+0xe1/0x150 [ 2.778136] device_driver_attach+0xa1/0xb0 [ 2.778184] __driver_attach+0x8a/0x150 [ 2.778229] ? device_driver_attach+0xb0/0xb0 [ 2.778277] ? device_driver_attach+0xb0/0xb0 [ 2.778365] bus_for_each_dev+0x64/0x90 [ 2.778446] bus_add_driver+0x12b/0x1e0 [ 2.778492] driver_register+0x8b/0xe0 [ 2.778536] ? 0xffffffffc0224000 [ 2.778582] vmwgfx_init+0x30/0x1000 [vmwgfx] [ 2.778632] do_one_initcall+0x46/0x200 [ 2.778677] ? _cond_resched+0x16/0x40 [ 2.778722] ? kmem_cache_alloc_trace+0x167/0x220 [ 2.778773] ? do_init_module+0x23/0x250 [ 2.778818] do_init_module+0x5c/0x250 [ 2.778863] __do_sys_finit_module+0x93/0xe0 [ 2.778912] do_syscall_64+0x52/0x90 [ 2.778955] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2.779009] RIP: 0033:0x7f202adf237d [ 2.779051] Code: Bad RIP value. [ 2.779092] RSP: 002b:00007ffca5b88dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 2.779171] RAX: ffffffffffffffda RBX: 000055b67ff12410 RCX: 00007f202adf237d [ 2.779239] RDX: 0000000000000000 RSI: 00007f202aa5195d RDI: 000000000000000f [ 2.779316] RBP: 0000000000020000 R08: 0000000000000000 R09: 000055b67ff125e0 [ 2.779446] R10: 000000000000000f R11: 0000000000000246 R12: 0000000000000000 [ 2.779514] R13: 00007f202aa5195d R14: 000055b67ff07570 R15: 000055b67ff04600 [ 2.779582] Modules linked in: vmwgfx(+) drm_kms_helper ttm drm crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel mptspi e1000(+) scsi_transport_spi serio_raw mptscsih mptbase ata_generic pata_acpi fuse [ 2.779753] CR2: 0000000000000190 [ 2.779794] ---[ end trace 5b38cb2d953a1310 ]--- [ 2.779851] RIP: 0010:drm_dev_has_vblank+0x5/0x20 [drm] [ 2.779907] Code: d0 0f 85 18 ff ff ff e9 2f ff ff ff 89 f1 89 e8 45 31 ff d3 e0 89 c1 e9 fa fe ff ff 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 <8b> 87 90 01 00 00 85 c0 0f 95 c0 c3 66 66 2e 0f 1f 84 00 00 00 00 [ 2.780072] RSP: 0000:ffffa9904078fb08 EFLAGS: 00010286 [ 2.780126] RAX: ffff8f0af2f02e00 RBX: ffff8f0af1ce3000 RCX: 0000000000000000 [ 2.780194] RDX: 0000000000000000 RSI: ffff8f0af2f02e00 RDI: 0000000000000000 [ 2.780262] RBP: ffff8f0af2f02e00 R08: ffff8f0b3be2f140 R09: 0000000000000000 [ 2.780367] R10: ffff8f0af2f02e00 R11: 3432524134325258 R12: 0000000000000000 [ 2.780452] R13: ffff8f0af1ce7000 R14: ffff8f0af1ce3000 R15: 0000000000000000 [ 2.780520] FS: 00007f2029cd0b80(0000) GS:ffff8f0b3be00000(0000) knlGS:0000000000000000 [ 2.780602] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2.780660] CR2: 0000000000000190 CR3: 0000000032c76003 CR4: 00000000003606f0

1 0

[PATCH v2] drm/connector: Add of_drm_find_connector
by Andy Yan 31 Jul '20

31 Jul '20

Add a function to look up a connector by device tree node, like what of_drm_find_bridge/panel does. Signed-off-by: Andy Yan <andy.yan(a)rock-chips.com> Reported-by: kernel test robot <lkp(a)intel.com> --- Changes in v2: - Add function declaration drivers/gpu/drm/drm_connector.c | 33 +++++++++++++++++++++++++++++++++ include/drm/drm_connector.h | 14 ++++++++++++++ 2 files changed, 47 insertions(+) diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c index d877ddc6dc57..516376cd1868 100644 --- a/drivers/gpu/drm/drm_connector.c +++ b/drivers/gpu/drm/drm_connector.c @@ -743,6 +743,39 @@ void drm_connector_list_iter_end(struct drm_connector_list_iter *iter) } EXPORT_SYMBOL(drm_connector_list_iter_end); +#ifdef CONFIG_OF +/** + * of_drm_find_connector - look up a connector using a device tree node + * @np: device tree node of the connector + * + * + * Return: A pointer to the connector which match the specified device tree + * node or NULL if no panel matching the device tree node can be found, or + * -ENODEV: the device is not available (status != "okay" or "ok") + */ +struct drm_connector *of_drm_find_connector(struct drm_device *dev, const struct device_node *np) +{ + struct drm_connector *connector; + struct drm_connector_list_iter conn_iter; + + if (!of_device_is_available(np)) + return ERR_PTR(-ENODEV); + + drm_connector_list_iter_begin(dev, &conn_iter); + drm_for_each_connector_iter(connector, &conn_iter) { + if (connector->of_node == np) { + drm_connector_list_iter_end(&conn_iter); + return connector; + } + } + drm_connector_list_iter_end(&conn_iter); + + return NULL; +} +EXPORT_SYMBOL(of_drm_find_connector); +#endif + + static const struct drm_prop_enum_list drm_subpixel_enum_list[] = { { SubPixelUnknown, "Unknown" }, { SubPixelHorizontalRGB, "Horizontal RGB" }, diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h index fd543d1db9b2..d249e0498375 100644 --- a/include/drm/drm_connector.h +++ b/include/drm/drm_connector.h @@ -1129,6 +1129,9 @@ struct drm_connector { /** @attr: sysfs attributes */ struct device_attribute *attr; + /** @of_node: device tree node */ + struct device_node *of_node; + /** * @head: * @@ -1647,6 +1650,17 @@ void drm_connector_list_iter_end(struct drm_connector_list_iter *iter); bool drm_connector_has_possible_encoder(struct drm_connector *connector, struct drm_encoder *encoder); +#if defined(CONFIG_OF) +struct drm_connector * +of_drm_find_connector(struct drm_device *dev, const struct device_node *np); +#else +static inline struct drm_connector * +of_drm_find_connector(struct drm_device *dev, const struct device_node *np) +{ + return ERR_PTR(-ENODEV); +} +#endif + /** * drm_for_each_connector_iter - connector_list iterator macro * @connector: &struct drm_connector pointer used as cursor -- 2.17.1

2 2

[PATCH] vgacon: Fix an out-of-bounds in vgacon_scrollback_update()
by Yang Yingliang 31 Jul '20

31 Jul '20

I got a slab-out-of-bounds report when I doing fuzz test. [ 334.989515] ================================================================== [ 334.989577] BUG: KASAN: slab-out-of-bounds in vgacon_scroll+0x57a/0x8ed [ 334.989588] Write of size 1766 at addr ffff8883de69ff3e by task test/2658 [ 334.989593] [ 334.989608] CPU: 3 PID: 2658 Comm: test Not tainted 5.7.0-rc5-00005-g152036d1379f #789 [ 334.989617] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 334.989624] Call Trace: [ 334.989646] dump_stack+0xe4/0x14e [ 334.989676] print_address_description.constprop.5+0x3f/0x60 [ 334.989699] ? vgacon_scroll+0x57a/0x8ed [ 334.989710] __kasan_report.cold.8+0x92/0xaf [ 334.989735] ? vgacon_scroll+0x57a/0x8ed [ 334.989761] kasan_report+0x37/0x50 [ 334.989789] check_memory_region+0x1c1/0x1e0 [ 334.989806] memcpy+0x38/0x60 [ 334.989824] vgacon_scroll+0x57a/0x8ed [ 334.989876] con_scroll+0x4ef/0x5e0 [ 334.989904] ? lockdep_hardirqs_on+0x5e0/0x5e0 [ 334.989934] lf+0x24f/0x2a0 [ 334.989951] ? con_scroll+0x5e0/0x5e0 [ 334.989975] ? find_held_lock+0x33/0x1c0 [ 334.990005] do_con_trol+0x313/0x5ff0 [ 334.990027] ? lock_downgrade+0x730/0x730 [ 334.990045] ? reset_palette+0x440/0x440 [ 334.990070] ? _raw_spin_unlock_irqrestore+0x4b/0x60 [ 334.990095] ? notifier_call_chain+0x120/0x170 [ 334.990132] ? __atomic_notifier_call_chain+0xf0/0x180 [ 334.990160] do_con_write.part.16+0xb2b/0x1b20 [ 334.990238] ? do_con_trol+0x5ff0/0x5ff0 [ 334.990258] ? mutex_lock_io_nested+0x1280/0x1280 [ 334.990269] ? rcu_read_unlock+0x50/0x50 [ 334.990315] ? __mutex_unlock_slowpath+0xd9/0x670 [ 334.990340] ? lockdep_hardirqs_on+0x3a2/0x5e0 [ 334.990368] con_write+0x36/0xc0 [ 334.990389] do_output_char+0x561/0x780 [ 334.990414] n_tty_write+0x58e/0xd30 [ 334.990478] ? n_tty_read+0x1800/0x1800 [ 334.990500] ? prepare_to_wait_exclusive+0x300/0x300 [ 334.990525] ? __might_fault+0x17a/0x1c0 [ 334.990557] tty_write+0x430/0x960 [ 334.990568] ? n_tty_read+0x1800/0x1800 [ 334.990600] ? tty_release+0x1280/0x1280 [ 334.990622] __vfs_write+0x81/0x100 [ 334.990648] vfs_write+0x1ce/0x510 [ 334.990676] ksys_write+0x104/0x200 [ 334.990691] ? __ia32_sys_read+0xb0/0xb0 [ 334.990708] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 334.990725] ? trace_hardirqs_off_caller+0x40/0x1a0 [ 334.990744] ? do_syscall_64+0x3b/0x5e0 [ 334.990775] do_syscall_64+0xc8/0x5e0 [ 334.990798] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 334.990811] RIP: 0033:0x44f369 [ 334.990827] Code: 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 334.990834] RSP: 002b:00007ffe9ace0968 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 334.990848] RAX: ffffffffffffffda RBX: 0000000000400418 RCX: 000000000044f369 [ 334.990856] RDX: 0000000000000381 RSI: 0000000020003500 RDI: 0000000000000003 [ 334.990865] RBP: 00007ffe9ace0980 R08: 0000000020003530 R09: 00007ffe9ace0980 [ 334.990873] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000402110 [ 334.990881] R13: 0000000000000000 R14: 00000000006bf018 R15: 0000000000000000 [ 334.990937] [ 334.990943] The buggy address belongs to the page: [ 334.990962] page:ffffea000f79a400 refcount:1 mapcount:0 mapping:000000002bff47b3 index:0x0 head:ffffea000f79a400 order:4 compound_mapcount:0 compound_pincount:0 [ 334.990973] flags: 0x2fffff80010000(head) [ 334.990992] raw: 002fffff80010000 dead000000000100 dead000000000122 0000000000000000 [ 334.991006] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 334.991013] page dumped because: kasan: bad access detected [ 334.991017] [ 334.991023] Memory state around the buggy address: [ 334.991034] ffff8883de6a0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 334.991044] ffff8883de6a0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 334.991054] >ffff8883de6a0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 334.991061] ^ [ 334.991071] ffff8883de6a0180: fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 00 [ 334.991082] ffff8883de6a0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 334.991088] ================================================================== Because vgacon_scrollback_cur->tail plus memcpy size is greater than vgacon_scrollback_cur->size. Fix this by checking the memcpy size. Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/video/console/vgacon.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c index 998b0de1812f..b51ffb9a208d 100644 --- a/drivers/video/console/vgacon.c +++ b/drivers/video/console/vgacon.c @@ -243,6 +243,7 @@ static void vgacon_scrollback_startup(void) static void vgacon_scrollback_update(struct vc_data *c, int t, int count) { void *p; + int size; if (!vgacon_scrollback_cur->data || !vgacon_scrollback_cur->size || c->vc_num != fg_console) @@ -251,13 +252,17 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count) p = (void *) (c->vc_origin + t * c->vc_size_row); while (count--) { + size = vgacon_scrollback_cur->size - vgacon_scrollback_cur->tail; + if (size > c->vc_size_row) + size = c->vc_size_row; + scr_memcpyw(vgacon_scrollback_cur->data + vgacon_scrollback_cur->tail, - p, c->vc_size_row); + p, size); vgacon_scrollback_cur->cnt++; - p += c->vc_size_row; - vgacon_scrollback_cur->tail += c->vc_size_row; + p += size; + vgacon_scrollback_cur->tail += size; if (vgacon_scrollback_cur->tail >= vgacon_scrollback_cur->size) vgacon_scrollback_cur->tail = 0; -- 2.25.1

2 5

[git pull] drm fixes for 5.8-rc8 (part 2)
by Dave Airlie 31 Jul '20

31 Jul '20

Hi Linus, As mentioned previously this contains the nouveau regression fix, amdgpu had 3 fixes outstanding as well, one revert, an info leak and use after free. The use after free is a bit trickier than I'd like, and I've personally gone over it to confirm I'm happy that it is doing what it says. Let me know if any issues with any, happy to respin if necessary. Dave. drm-fixes-2020-07-31: drm fixes for 5.8-rc8 (part 2) nouveau: - final modifiers regression fix amdgpu: - Revert a fix which caused other regressions - Fix potential kernel info leak - Fix a use-after-free bug that was uncovered by another change in 5.7 The following changes since commit a4a2739beb8933a19281bca077fdb852598803ed: Merge tag 'drm-misc-fixes-2020-07-28' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes (2020-07-29 12:46:58 +1000) are available in the Git repository at: git://anongit.freedesktop.org/drm/drm tags/drm-fixes-2020-07-31 for you to fetch changes up to 887c909dd5d557c203a233ebbe238c18438a680a: Merge tag 'amd-drm-fixes-5.8-2020-07-30' of git://people.freedesktop.org/~agd5f/linux into drm-fixes (2020-07-31 13:04:00 +1000) ---------------------------------------------------------------- drm fixes for 5.8-rc8 (part 2) nouveau: - final modifiers regression fix amdgpu: - Revert a fix which caused other regressions - Fix potential kernel info leak - Fix a use-after-free bug that was uncovered by another change in 5.7 ---------------------------------------------------------------- Alex Deucher (1): Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers" Dave Airlie (1): Merge tag 'amd-drm-fixes-5.8-2020-07-30' of git://people.freedesktop.org/~agd5f/linux into drm-fixes James Jones (1): drm/nouveau: Accept 'legacy' format modifiers Mazin Rezk (1): drm/amd/display: Clear dm_state for fast updates Peilin Ye (1): drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl() drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 9 ++++-- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 36 +++++++++++++++++------ drivers/gpu/drm/nouveau/nouveau_display.c | 27 +++++++++++++++-- 4 files changed, 60 insertions(+), 15 deletions(-)

2 1

[PATCH drm/hisilicon 0/2] hibmc clean up
by Tian Tao 31 Jul '20

31 Jul '20

Do some refactoring of the code, #1 is clean up, #2 is for code refactoring. Tian Tao (2): drm/hisilicon: Remove the unnecessary header files drm/hisilicon: Code refactoring for hibmc_drv_de drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 58 ++++++------------------ drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 5 -- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 2 + drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 2 - 4 files changed, 15 insertions(+), 52 deletions(-) -- 2.7.4

1 0

[PATCH v3] drm/nouveau: Accept 'legacy' format modifiers
by James Jones 30 Jul '20

30 Jul '20

Accept the DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK() family of modifiers to handle broken userspace Xorg modesetting and Mesa drivers. Existing Mesa drivers are still aware of only these older format modifiers which do not differentiate between different variations of the block linear layout. When the format modifier support flag was flipped in the nouveau kernel driver, the X.org modesetting driver began attempting to use its format modifier-enabled framebuffer path. Because the set of format modifiers advertised by the kernel prior to this change do not intersect with the set of format modifiers advertised by Mesa, allocating GBM buffers using format modifiers fails and the modesetting driver falls back to non-modifier allocation. However, it still later queries the modifier of the GBM buffer when creating its DRM-KMS framebuffer object, receives the old-format modifier from Mesa, and attempts to create a framebuffer with it. Since the kernel is still not aware of these formats, this fails. Userspace should not be attempting to query format modifiers of GBM buffers allocated with a non- format-modifier-aware allocation path, but to avoid breaking existing userspace behavior, this change accepts the old-style format modifiers when creating framebuffers and applying them to planes by translating them to the equivalent new-style modifier. To accomplish this, some layout parameters must be assumed to match properties of the device targeted by the relevant ioctls. To avoid perpetuating misuse of the old-style modifiers, this change does not advertise support for them. Doing so would imply compatibility between devices with incompatible memory layouts. Tested with Xorg 1.20 modesetting driver, weston@c46c70dac84a4b3030cd05b380f9f410536690fc, gnome & KDE wayland desktops from Ubuntu 18.04, kmscube hacked to use linear mod, and sway 1.5 Reported-by: Kirill A. Shutemov <kirill(a)shutemov.name> Fixes: fa4f4c213f5f ("drm/nouveau/kms: Support NVIDIA format modifiers") Link: https://lkml.org/lkml/2020/6/30/1251 Signed-off-by: James Jones <jajones(a)nvidia.com> --- drivers/gpu/drm/nouveau/nouveau_display.c | 26 +++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c index 496c4621cc78..31543086254b 100644 --- a/drivers/gpu/drm/nouveau/nouveau_display.c +++ b/drivers/gpu/drm/nouveau/nouveau_display.c @@ -191,8 +191,14 @@ nouveau_decode_mod(struct nouveau_drm *drm, uint32_t *tile_mode, uint8_t *kind) { + struct nouveau_display *disp = nouveau_display(drm->dev); BUG_ON(!tile_mode || !kind); + if ((modifier & (0xffull << 12)) == 0ull) { + /* Legacy modifier. Translate to this device's 'kind.' */ + modifier |= disp->format_modifiers[0] & (0xffull << 12); + } + if (modifier == DRM_FORMAT_MOD_LINEAR) { /* tile_mode will not be used in this case */ *tile_mode = 0; @@ -227,6 +233,16 @@ nouveau_framebuffer_get_layout(struct drm_framebuffer *fb, } } +static const u64 legacy_modifiers[] = { + DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(0), + DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(1), + DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(2), + DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(3), + DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(4), + DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(5), + DRM_FORMAT_MOD_INVALID +}; + static int nouveau_validate_decode_mod(struct nouveau_drm *drm, uint64_t modifier, @@ -247,8 +263,14 @@ nouveau_validate_decode_mod(struct nouveau_drm *drm, (disp->format_modifiers[mod] != modifier); mod++); - if (disp->format_modifiers[mod] == DRM_FORMAT_MOD_INVALID) - return -EINVAL; + if (disp->format_modifiers[mod] == DRM_FORMAT_MOD_INVALID) { + for (mod = 0; + (legacy_modifiers[mod] != DRM_FORMAT_MOD_INVALID) && + (legacy_modifiers[mod] != modifier); + mod++); + if (legacy_modifiers[mod] == DRM_FORMAT_MOD_INVALID) + return -EINVAL; + } nouveau_decode_mod(drm, modifier, tile_mode, kind); -- 2.17.1

2 2

[PATCH v4] drm/nouveau: Accept 'legacy' format modifiers
by James Jones 30 Jul '20

30 Jul '20

Accept the DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK() family of modifiers to handle broken userspace Xorg modesetting and Mesa drivers. Existing Mesa drivers are still aware of only these older format modifiers which do not differentiate between different variations of the block linear layout. When the format modifier support flag was flipped in the nouveau kernel driver, the X.org modesetting driver began attempting to use its format modifier-enabled framebuffer path. Because the set of format modifiers advertised by the kernel prior to this change do not intersect with the set of format modifiers advertised by Mesa, allocating GBM buffers using format modifiers fails and the modesetting driver falls back to non-modifier allocation. However, it still later queries the modifier of the GBM buffer when creating its DRM-KMS framebuffer object, receives the old-format modifier from Mesa, and attempts to create a framebuffer with it. Since the kernel is still not aware of these formats, this fails. Userspace should not be attempting to query format modifiers of GBM buffers allocated with a non- format-modifier-aware allocation path, but to avoid breaking existing userspace behavior, this change accepts the old-style format modifiers when creating framebuffers and applying them to planes by translating them to the equivalent new-style modifier. To accomplish this, some layout parameters must be assumed to match properties of the device targeted by the relevant ioctls. To avoid perpetuating misuse of the old-style modifiers, this change does not advertise support for them. Doing so would imply compatibility between devices with incompatible memory layouts. Tested with Xorg 1.20 modesetting driver, weston@c46c70dac84a4b3030cd05b380f9f410536690fc, gnome & KDE wayland desktops from Ubuntu 18.04, and sway 1.5 Reported-by: Kirill A. Shutemov <kirill(a)shutemov.name> Fixes: fa4f4c213f5f ("drm/nouveau/kms: Support NVIDIA format modifiers") Link: https://lkml.org/lkml/2020/6/30/1251 Signed-off-by: James Jones <jajones(a)nvidia.com> --- drivers/gpu/drm/nouveau/nouveau_display.c | 27 +++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c index 496c4621cc78..07373bbc2acf 100644 --- a/drivers/gpu/drm/nouveau/nouveau_display.c +++ b/drivers/gpu/drm/nouveau/nouveau_display.c @@ -191,6 +191,7 @@ nouveau_decode_mod(struct nouveau_drm *drm, uint32_t *tile_mode, uint8_t *kind) { + struct nouveau_display *disp = nouveau_display(drm->dev); BUG_ON(!tile_mode || !kind); if (modifier == DRM_FORMAT_MOD_LINEAR) { @@ -202,6 +203,12 @@ nouveau_decode_mod(struct nouveau_drm *drm, * Extract the block height and kind from the corresponding * modifier fields. See drm_fourcc.h for details. */ + + if ((modifier & (0xffull << 12)) == 0ull) { + /* Legacy modifier. Translate to this dev's 'kind.' */ + modifier |= disp->format_modifiers[0] & (0xffull << 12); + } + *tile_mode = (uint32_t)(modifier & 0xF); *kind = (uint8_t)((modifier >> 12) & 0xFF); @@ -227,6 +234,16 @@ nouveau_framebuffer_get_layout(struct drm_framebuffer *fb, } } +static const u64 legacy_modifiers[] = { + DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(0), + DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(1), + DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(2), + DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(3), + DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(4), + DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(5), + DRM_FORMAT_MOD_INVALID +}; + static int nouveau_validate_decode_mod(struct nouveau_drm *drm, uint64_t modifier, @@ -247,8 +264,14 @@ nouveau_validate_decode_mod(struct nouveau_drm *drm, (disp->format_modifiers[mod] != modifier); mod++); - if (disp->format_modifiers[mod] == DRM_FORMAT_MOD_INVALID) - return -EINVAL; + if (disp->format_modifiers[mod] == DRM_FORMAT_MOD_INVALID) { + for (mod = 0; + (legacy_modifiers[mod] != DRM_FORMAT_MOD_INVALID) && + (legacy_modifiers[mod] != modifier); + mod++); + if (legacy_modifiers[mod] == DRM_FORMAT_MOD_INVALID) + return -EINVAL; + } nouveau_decode_mod(drm, modifier, tile_mode, kind); -- 2.17.1

1 0

← Newer
1
...
20
21
22
23
24
25
26
...
78
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

dri-devel July 2020