From mboxrd@z Thu Jan 1 00:00:00 1970 From: Greg Kroah-Hartman Subject: [PATCH 4.12 23/65] drm/i915: Fix out-of-bounds array access in bdw_load_gamma_lut Date: Mon, 14 Aug 2017 18:19:14 -0700 Message-ID: <20170815011943.314063116@linuxfoundation.org> References: <20170815011942.395714306@linuxfoundation.org> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) by gabe.freedesktop.org (Postfix) with ESMTPS id C105089DE6 for ; Tue, 15 Aug 2017 01:20:05 +0000 (UTC) In-Reply-To: <20170815011942.395714306@linuxfoundation.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" To: linux-kernel@vger.kernel.org Cc: Jani Nikula , Greg Kroah-Hartman , intel-gfx@lists.freedesktop.org, stable@vger.kernel.org, Kausal Malladi , Daniel Vetter , Kiran S Kumar List-Id: intel-gfx@lists.freedesktop.org NC4xMi1zdGFibGUgcmV2aWV3IHBhdGNoLiAgSWYgYW55b25lIGhhcyBhbnkgb2JqZWN0aW9ucywg cGxlYXNlIGxldCBtZSBrbm93LgoKLS0tLS0tLS0tLS0tLS0tLS0tCgpGcm9tOiBNYWFydGVuIExh bmtob3JzdCA8bWFhcnRlbi5sYW5raG9yc3RAbGludXguaW50ZWwuY29tPgoKY29tbWl0IDUyNzlm Yzc3MjRhZTNhODJjOWNmZTViMDljMWZiMDdmZjBlNDEwNTYgdXBzdHJlYW0uCgpiZHdfbG9hZF9n YW1tYV9sdXQgaXMgd3JpdGluZyBiZXlvbmQgdGhlIGFycmF5IHRvIHRoZSBtYXhpbXVtIHZhbHVl LgpUaGUgaW50ZW5kIG9mIHRoZSBmdW5jdGlvbiBpcyB0byBjbGFtcCB2YWx1ZXMgPiAxIHRvIDEs IHNvIHdyaXRlCnRoZSBpbnRlbmRlZCBjb2xvciB0byB0aGUgbWF4IHJlZ2lzdGVyLgoKVGhpcyBm aXhlcyB0aGUgZm9sbG93aW5nIEtBU0FOIHdhcm5pbmc6CgpbICAxOTcuMDIwODU3XSBbSUdUXSBr bXNfcGlwZV9jb2xvcjogZXhlY3V0aW5nClsgIDE5Ny4wNjM0MzRdIFtJR1RdIGttc19waXBlX2Nv bG9yOiBzdGFydGluZyBzdWJ0ZXN0IGN0bS0wLTI1LXBpcGUwClsgIDE5Ny4wNzg5ODldID09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQpbICAxOTcuMDc5MTI3XSBCVUc6IEtBU0FOOiBzbGFiLW91dC1vZi1ib3VuZHMgaW4gYmR3 X2xvYWRfZ2FtbWFfbHV0LmlzcmEuMisweDNiOS8weDU3MCBbaTkxNV0KWyAgMTk3LjA3OTE4OF0g UmVhZCBvZiBzaXplIDIgYXQgYWRkciBmZmZmODgwMGQzOGRiMTUwIGJ5IHRhc2sga21zX3BpcGVf Y29sb3IvMTgzOQpbICAxOTcuMDc5MjA4XSBDUFU6IDIgUElEOiAxODM5IENvbW06IGttc19waXBl X2NvbG9yIFRhaW50ZWQ6IEcgICAgIFUgNC4xMy4wLXJjMS1wYXRzZXIrICM1MjExClsgIDE5Ny4w NzkyMTVdIEhhcmR3YXJlIG5hbWU6IE5VQzVpN1JZQiwgQklPUyBSWUJEV2kzNS44NkEuMDI0Ni4y MDE1LjAzMDkuMTM1NSAwMy8wOS8yMDE1ClsgIDE5Ny4wNzkyMjBdIENhbGwgVHJhY2U6ClsgIDE5 Ny4wNzkyMzBdICBkdW1wX3N0YWNrKzB4NjgvMHg5ZQpbICAxOTcuMDc5MjM5XSAgcHJpbnRfYWRk cmVzc19kZXNjcmlwdGlvbisweDZmLzB4MjUwClsgIDE5Ny4wNzkyNTFdICBrYXNhbl9yZXBvcnQr MHgyMTYvMHgzNzAKWyAgMTk3LjA3OTM3NF0gID8gYmR3X2xvYWRfZ2FtbWFfbHV0LmlzcmEuMisw eDNiOS8weDU3MCBbaTkxNV0KWyAgMTk3LjA3OTQ1MV0gID8gZ2VuOF93cml0ZTE2KzB4NGUwLzB4 NGUwIFtpOTE1XQpbICAxOTcuMDc5NDYwXSAgX19hc2FuX3JlcG9ydF9sb2FkMl9ub2Fib3J0KzB4 MTQvMHgyMApbICAxOTcuMDc5NTM1XSAgYmR3X2xvYWRfZ2FtbWFfbHV0LmlzcmEuMisweDNiOS8w eDU3MCBbaTkxNV0KWyAgMTk3LjA3OTYxMl0gIGJyb2Fkd2VsbF9sb2FkX2x1dHMrMHgxZGYvMHg1 NTAgW2k5MTVdClsgIDE5Ny4wNzk2OTBdICBpbnRlbF9jb2xvcl9sb2FkX2x1dHMrMHg3Yi8weDgw IFtpOTE1XQpbICAxOTcuMDc5NzY0XSAgaW50ZWxfYmVnaW5fY3J0Y19jb21taXQrMHgxMzgvMHg3 NjAgW2k5MTVdClsgIDE5Ny4wNzk3ODNdICBkcm1fYXRvbWljX2hlbHBlcl9jb21taXRfcGxhbmVz X29uX2NydGMrMHgxYTMvMHg4MjAgW2RybV9rbXNfaGVscGVyXQpbICAxOTcuMDc5ODU5XSAgPyBp bnRlbF9wcmVfcGxhbmVfdXBkYXRlKzB4NTcxLzB4NTgwIFtpOTE1XQpbICAxOTcuMDc5OTM3XSAg aW50ZWxfdXBkYXRlX2NydGMrMHgyMzgvMHgzMzAgW2k5MTVdClsgIDE5Ny4wODAwMTZdICBpbnRl bF91cGRhdGVfY3J0Y3MrMHgxMGYvMHgyMTAgW2k5MTVdClsgIDE5Ny4wODAwOTJdICBpbnRlbF9h dG9taWNfY29tbWl0X3RhaWwrMHgxNTUyLzB4MzM0MCBbaTkxNV0KWyAgMTk3LjA4MDEwMV0gID8g X3Jhd19zcGluX3VubG9jaysweDNjLzB4NDAKWyAgMTk3LjA4MDExMF0gID8gX19xdWV1ZV93b3Jr KzB4YjQwLzB4YmYwClsgIDE5Ny4wODAxODhdICA/IHNrbF91cGRhdGVfY3J0Y3MrMHhjMDAvMHhj MDAgW2k5MTVdClsgIDE5Ny4wODAxOTVdICA/IHRyYWNlX2hhcmRpcnFzX29uKzB4ZC8weDEwClsg IDE5Ny4wODAyNjldICA/IGludGVsX2F0b21pY19jb21taXRfcmVhZHkrMHgxMjgvMHgxM2MgW2k5 MTVdClsgIDE5Ny4wODAzMjldICA/IF9faTkxNV9zd19mZW5jZV9jb21wbGV0ZSsweDViOC8weDZk MCBbaTkxNV0KWyAgMTk3LjA4MDMzNl0gID8gZGVidWdfb2JqZWN0X2FjdGl2YXRlKzB4MzllLzB4 NTgwClsgIDE5Ny4wODAzOTddICA/IGk5MTVfc3dfZmVuY2VfYXdhaXQrMHgzMC8weDMwIFtpOTE1 XQpbICAxOTcuMDgwNDA5XSAgPyBfX21pZ2h0X3NsZWVwKzB4MTViLzB4MTgwClsgIDE5Ny4wODA0 ODNdICBpbnRlbF9hdG9taWNfY29tbWl0KzB4OTQ0LzB4YTcwIFtpOTE1XQpbICAxOTcuMDgwNDkw XSAgPyByZWZjb3VudF9kZWNfYW5kX3Rlc3QrMHgxMS8weDIwClsgIDE5Ny4wODA1NjddICA/IGlu dGVsX2F0b21pY19jb21taXRfdGFpbCsweDMzNDAvMHgzMzQwIFtpOTE1XQpbICAxOTcuMDgwNTk3 XSAgPyBkcm1fYXRvbWljX2NydGNfc2V0X3Byb3BlcnR5KzB4MzAzLzB4NTgwIFtkcm1dClsgIDE5 Ny4wODA2NzRdICA/IGludGVsX2F0b21pY19jb21taXRfdGFpbCsweDMzNDAvMHgzMzQwIFtpOTE1 XQpbICAxOTcuMDgwNzA0XSAgZHJtX2F0b21pY19jb21taXQrMHhkNy8weGUwIFtkcm1dClsgIDE5 Ny4wODA3MjJdICBkcm1fYXRvbWljX2hlbHBlcl9jcnRjX3NldF9wcm9wZXJ0eSsweGVjLzB4MTMw IFtkcm1fa21zX2hlbHBlcl0KWyAgMTk3LjA4MDc0OV0gIGRybV9tb2RlX2NydGNfc2V0X29ial9w cm9wKzB4N2QvMHhiMCBbZHJtXQpbICAxOTcuMDgwNzc1XSAgZHJtX21vZGVfb2JqX3NldF9wcm9w ZXJ0eV9pb2N0bCsweDUwYi8weDVkMCBbZHJtXQpbICAxOTcuMDgwNzgzXSAgPyBfX21pZ2h0X2Zh dWx0KzB4MTA0LzB4MTgwClsgIDE5Ny4wODA4MDldICA/IGRybV9tb2RlX29ial9maW5kX3Byb3Bf aWQrMHgxNjAvMHgxNjAgW2RybV0KWyAgMTk3LjA4MDgzOF0gID8gZHJtX21vZGVfb2JqX2ZpbmRf cHJvcF9pZCsweDE2MC8weDE2MCBbZHJtXQpbICAxOTcuMDgwODYxXSAgZHJtX2lvY3RsX2tlcm5l bCsweDE1NC8weDFhMCBbZHJtXQpbICAxOTcuMDgwODg1XSAgZHJtX2lvY3RsKzB4NjI0LzB4OGYw IFtkcm1dClsgIDE5Ny4wODA5MTBdICA/IGRybV9tb2RlX29ial9maW5kX3Byb3BfaWQrMHgxNjAv MHgxNjAgW2RybV0KWyAgMTk3LjA4MDkzNF0gID8gZHJtX2dldHVuaXF1ZSsweDIxMC8weDIxMCBb ZHJtXQpbICAxOTcuMDgwOTQzXSAgPyBfX2hhbmRsZV9tbV9mYXVsdCsweDFiZDAvMHgxY2UwClsg IDE5Ny4wODA5NDldICA/IGxvY2tfZG93bmdyYWRlKzB4NjEwLzB4NjEwClsgIDE5Ny4wODA5NTdd ICA/IF9fbHJ1X2NhY2hlX2FkZCsweDE1YS8weDE4MApbICAxOTcuMDgwOTY3XSAgZG9fdmZzX2lv Y3RsKzB4ZDkyLzB4ZTQwClsgIDE5Ny4wODA5NzVdICA/IGlvY3RsX3ByZWFsbG9jYXRlKzB4MWIw LzB4MWIwClsgIDE5Ny4wODA5ODJdICA/IHNlbGludXhfY2FwYWJsZSsweDIwLzB4MjAKWyAgMTk3 LjA4MDk5MV0gID8gX19kb19wYWdlX2ZhdWx0KzB4N2I3LzB4OWEwClsgIDE5Ny4wODA5OTddICA/ IGxvY2tfZG93bmdyYWRlKzB4NWJiLzB4NjEwClsgIDE5Ny4wODEwMDddICA/IHNlY3VyaXR5X2Zp bGVfaW9jdGwrMHg1Ny8weDkwClsgIDE5Ny4wODEwMTZdICBTeVNfaW9jdGwrMHg0ZS8weDgwClsg IDE5Ny4wODEwMjRdICBlbnRyeV9TWVNDQUxMXzY0X2Zhc3RwYXRoKzB4MTgvMHhhZApbICAxOTcu MDgxMDMwXSBSSVA6IDAwMzM6MHg3ZjYxZjI4N2E5ODcKWyAgMTk3LjA4MTAzNV0gUlNQOiAwMDJi OjAwMDA3ZmZmN2Q0NGQxODggRUZMQUdTOiAwMDAwMDI0NiBPUklHX1JBWDogMDAwMDAwMDAwMDAw MDAxMApbICAxOTcuMDgxMDQzXSBSQVg6IGZmZmZmZmZmZmZmZmZmZGEgUkJYOiAwMDAwMDAwMDAw MDAwMDAwIFJDWDogMDAwMDdmNjFmMjg3YTk4NwpbICAxOTcuMDgxMDQ4XSBSRFg6IDAwMDA3ZmZm N2Q0NGQxYzAgUlNJOiAwMDAwMDAwMGMwMTg2NGJhIFJESTogMDAwMDAwMDAwMDAwMDAwMwpbICAx OTcuMDgxMDUzXSBSQlA6IDAwMDA3ZjYxZjJiM2ViMDAgUjA4OiAwMDAwMDAwMDAwMDAwMDU5IFIw OTogMDAwMDAwMDAwMDAwMDAwMApbICAxOTcuMDgxMDU4XSBSMTA6IDAwMDAwMDJlYTVjNGEyOTAg UjExOiAwMDAwMDAwMDAwMDAwMjQ2IFIxMjogMDAwMDdmNjFmMmIzZWI1OApbICAxOTcuMDgxMDYz XSBSMTM6IDAwMDAwMDAwMDAwMDEwMTAgUjE0OiAwMDAwN2Y2MWYyYjNlYjU4IFIxNTogMDAwMDAw MDAwMDAwMjcwMgoKQnVnemlsbGE6IGh0dHBzOi8vYnVncy5mcmVlZGVza3RvcC5vcmcvc2hvd19i dWcuY2dpP2lkPTEwMTY1OQpTaWduZWQtb2ZmLWJ5OiBNYWFydGVuIExhbmtob3JzdCA8bWFhcnRl bi5sYW5raG9yc3RAbGludXguaW50ZWwuY29tPgpSZXBvcnRlZC1ieTogTWFydGluIFBlcmVzIDxt YXJ0aW4ucGVyZXNAbGludXguaW50ZWwuY29tPgpDYzogTWFydGluIFBlcmVzIDxtYXJ0aW4ucGVy ZXNAbGludXguaW50ZWwuY29tPgpGaXhlczogODJjZjQzNWIzMTM0ICgiZHJtL2k5MTU6IEltcGxl bWVudCBjb2xvciBtYW5hZ2VtZW50IG9uIGJkdy9za2wvYnh0L2tibCIpCkNjOiBTaGFzaGFuayBT aGFybWEgPHNoYXNoYW5rLnNoYXJtYUBpbnRlbC5jb20+CkNjOiBLaXJhbiBTIEt1bWFyIDxraXJh bi5zLmt1bWFyQGludGVsLmNvbT4KQ2M6IEthdXNhbCBNYWxsYWRpIDxrYXVzYWxtYWxsYWRpQGdt YWlsLmNvbT4KQ2M6IExpb25lbCBMYW5kd2VybGluIDxsaW9uZWwuZy5sYW5kd2VybGluQGludGVs LmNvbT4KQ2M6IE1hdHQgUm9wZXIgPG1hdHRoZXcuZC5yb3BlckBpbnRlbC5jb20+CkNjOiBEYW5p ZWwgVmV0dGVyIDxkYW5pZWwudmV0dGVyQGludGVsLmNvbT4KQ2M6IEphbmkgTmlrdWxhIDxqYW5p Lm5pa3VsYUBsaW51eC5pbnRlbC5jb20+CkNjOiBpbnRlbC1nZnhAbGlzdHMuZnJlZWRlc2t0b3Au b3JnCkxpbms6IGh0dHBzOi8vcGF0Y2h3b3JrLmZyZWVkZXNrdG9wLm9yZy9wYXRjaC9tc2dpZC8y MDE3MDcyNDA5MTQzMS4yNDI1MS0xLW1hYXJ0ZW4ubGFua2hvcnN0QGxpbnV4LmludGVsLmNvbQpS ZXZpZXdlZC1ieTogTGlvbmVsIExhbmR3ZXJsaW4gPGxpb25lbC5nLmxhbmR3ZXJsaW5AaW50ZWwu Y29tPgooY2hlcnJ5IHBpY2tlZCBmcm9tIGNvbW1pdCAwOWE5MmJjODc3M2I0MzE0ZTAyYjQ3OGUw MDNmZTU5MzZjZTg1YWRiKQpTaWduZWQtb2ZmLWJ5OiBKYW5pIE5pa3VsYSA8amFuaS5uaWt1bGFA aW50ZWwuY29tPgpTaWduZWQtb2ZmLWJ5OiBHcmVnIEtyb2FoLUhhcnRtYW4gPGdyZWdraEBsaW51 eGZvdW5kYXRpb24ub3JnPgoKLS0tCiBkcml2ZXJzL2dwdS9kcm0vaTkxNS9pbnRlbF9jb2xvci5j IHwgICAgMSArCiAxIGZpbGUgY2hhbmdlZCwgMSBpbnNlcnRpb24oKykKCi0tLSBhL2RyaXZlcnMv Z3B1L2RybS9pOTE1L2ludGVsX2NvbG9yLmMKKysrIGIvZHJpdmVycy9ncHUvZHJtL2k5MTUvaW50 ZWxfY29sb3IuYwpAQCAtMzk4LDYgKzM5OCw3IEBAIHN0YXRpYyB2b2lkIGJkd19sb2FkX2dhbW1h X2x1dChzdHJ1Y3QgZHIKIAkJfQogCiAJCS8qIFByb2dyYW0gdGhlIG1heCByZWdpc3RlciB0byBj bGFtcCB2YWx1ZXMgPiAxLjAuICovCisJCWkgPSBsdXRfc2l6ZSAtIDE7CiAJCUk5MTVfV1JJVEUo UFJFQ19QQUxfR0NfTUFYKHBpcGUsIDApLAogCQkJICAgZHJtX2NvbG9yX2x1dF9leHRyYWN0KGx1 dFtpXS5yZWQsIDE2KSk7CiAJCUk5MTVfV1JJVEUoUFJFQ19QQUxfR0NfTUFYKHBpcGUsIDEpLAoK Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkludGVsLWdm eCBtYWlsaW5nIGxpc3QKSW50ZWwtZ2Z4QGxpc3RzLmZyZWVkZXNrdG9wLm9yZwpodHRwczovL2xp c3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2ludGVsLWdmeAo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753754AbdHOBdM (ORCPT ); Mon, 14 Aug 2017 21:33:12 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:57234 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753659AbdHOBUG (ORCPT ); Mon, 14 Aug 2017 21:20:06 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maarten Lankhorst , Martin Peres , Shashank Sharma , Kiran S Kumar , Kausal Malladi , Lionel Landwerlin , Matt Roper , Daniel Vetter , Jani Nikula , intel-gfx@lists.freedesktop.org, Jani Nikula Subject: [PATCH 4.12 23/65] drm/i915: Fix out-of-bounds array access in bdw_load_gamma_lut Date: Mon, 14 Aug 2017 18:19:14 -0700 Message-Id: <20170815011943.314063116@linuxfoundation.org> X-Mailer: git-send-email 2.14.0 In-Reply-To: <20170815011942.395714306@linuxfoundation.org> References: <20170815011942.395714306@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Maarten Lankhorst commit 5279fc7724ae3a82c9cfe5b09c1fb07ff0e41056 upstream. bdw_load_gamma_lut is writing beyond the array to the maximum value. The intend of the function is to clamp values > 1 to 1, so write the intended color to the max register. This fixes the following KASAN warning: [ 197.020857] [IGT] kms_pipe_color: executing [ 197.063434] [IGT] kms_pipe_color: starting subtest ctm-0-25-pipe0 [ 197.078989] ================================================================== [ 197.079127] BUG: KASAN: slab-out-of-bounds in bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915] [ 197.079188] Read of size 2 at addr ffff8800d38db150 by task kms_pipe_color/1839 [ 197.079208] CPU: 2 PID: 1839 Comm: kms_pipe_color Tainted: G U 4.13.0-rc1-patser+ #5211 [ 197.079215] Hardware name: NUC5i7RYB, BIOS RYBDWi35.86A.0246.2015.0309.1355 03/09/2015 [ 197.079220] Call Trace: [ 197.079230] dump_stack+0x68/0x9e [ 197.079239] print_address_description+0x6f/0x250 [ 197.079251] kasan_report+0x216/0x370 [ 197.079374] ? bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915] [ 197.079451] ? gen8_write16+0x4e0/0x4e0 [i915] [ 197.079460] __asan_report_load2_noabort+0x14/0x20 [ 197.079535] bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915] [ 197.079612] broadwell_load_luts+0x1df/0x550 [i915] [ 197.079690] intel_color_load_luts+0x7b/0x80 [i915] [ 197.079764] intel_begin_crtc_commit+0x138/0x760 [i915] [ 197.079783] drm_atomic_helper_commit_planes_on_crtc+0x1a3/0x820 [drm_kms_helper] [ 197.079859] ? intel_pre_plane_update+0x571/0x580 [i915] [ 197.079937] intel_update_crtc+0x238/0x330 [i915] [ 197.080016] intel_update_crtcs+0x10f/0x210 [i915] [ 197.080092] intel_atomic_commit_tail+0x1552/0x3340 [i915] [ 197.080101] ? _raw_spin_unlock+0x3c/0x40 [ 197.080110] ? __queue_work+0xb40/0xbf0 [ 197.080188] ? skl_update_crtcs+0xc00/0xc00 [i915] [ 197.080195] ? trace_hardirqs_on+0xd/0x10 [ 197.080269] ? intel_atomic_commit_ready+0x128/0x13c [i915] [ 197.080329] ? __i915_sw_fence_complete+0x5b8/0x6d0 [i915] [ 197.080336] ? debug_object_activate+0x39e/0x580 [ 197.080397] ? i915_sw_fence_await+0x30/0x30 [i915] [ 197.080409] ? __might_sleep+0x15b/0x180 [ 197.080483] intel_atomic_commit+0x944/0xa70 [i915] [ 197.080490] ? refcount_dec_and_test+0x11/0x20 [ 197.080567] ? intel_atomic_commit_tail+0x3340/0x3340 [i915] [ 197.080597] ? drm_atomic_crtc_set_property+0x303/0x580 [drm] [ 197.080674] ? intel_atomic_commit_tail+0x3340/0x3340 [i915] [ 197.080704] drm_atomic_commit+0xd7/0xe0 [drm] [ 197.080722] drm_atomic_helper_crtc_set_property+0xec/0x130 [drm_kms_helper] [ 197.080749] drm_mode_crtc_set_obj_prop+0x7d/0xb0 [drm] [ 197.080775] drm_mode_obj_set_property_ioctl+0x50b/0x5d0 [drm] [ 197.080783] ? __might_fault+0x104/0x180 [ 197.080809] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm] [ 197.080838] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm] [ 197.080861] drm_ioctl_kernel+0x154/0x1a0 [drm] [ 197.080885] drm_ioctl+0x624/0x8f0 [drm] [ 197.080910] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm] [ 197.080934] ? drm_getunique+0x210/0x210 [drm] [ 197.080943] ? __handle_mm_fault+0x1bd0/0x1ce0 [ 197.080949] ? lock_downgrade+0x610/0x610 [ 197.080957] ? __lru_cache_add+0x15a/0x180 [ 197.080967] do_vfs_ioctl+0xd92/0xe40 [ 197.080975] ? ioctl_preallocate+0x1b0/0x1b0 [ 197.080982] ? selinux_capable+0x20/0x20 [ 197.080991] ? __do_page_fault+0x7b7/0x9a0 [ 197.080997] ? lock_downgrade+0x5bb/0x610 [ 197.081007] ? security_file_ioctl+0x57/0x90 [ 197.081016] SyS_ioctl+0x4e/0x80 [ 197.081024] entry_SYSCALL_64_fastpath+0x18/0xad [ 197.081030] RIP: 0033:0x7f61f287a987 [ 197.081035] RSP: 002b:00007fff7d44d188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 197.081043] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f61f287a987 [ 197.081048] RDX: 00007fff7d44d1c0 RSI: 00000000c01864ba RDI: 0000000000000003 [ 197.081053] RBP: 00007f61f2b3eb00 R08: 0000000000000059 R09: 0000000000000000 [ 197.081058] R10: 0000002ea5c4a290 R11: 0000000000000246 R12: 00007f61f2b3eb58 [ 197.081063] R13: 0000000000001010 R14: 00007f61f2b3eb58 R15: 0000000000002702 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101659 Signed-off-by: Maarten Lankhorst Reported-by: Martin Peres Cc: Martin Peres Fixes: 82cf435b3134 ("drm/i915: Implement color management on bdw/skl/bxt/kbl") Cc: Shashank Sharma Cc: Kiran S Kumar Cc: Kausal Malladi Cc: Lionel Landwerlin Cc: Matt Roper Cc: Daniel Vetter Cc: Jani Nikula Cc: intel-gfx@lists.freedesktop.org Link: https://patchwork.freedesktop.org/patch/msgid/20170724091431.24251-1-maarten.lankhorst@linux.intel.com Reviewed-by: Lionel Landwerlin (cherry picked from commit 09a92bc8773b4314e02b478e003fe5936ce85adb) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/intel_color.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/gpu/drm/i915/intel_color.c +++ b/drivers/gpu/drm/i915/intel_color.c @@ -398,6 +398,7 @@ static void bdw_load_gamma_lut(struct dr } /* Program the max register to clamp values > 1.0. */ + i = lut_size - 1; I915_WRITE(PREC_PAL_GC_MAX(pipe, 0), drm_color_lut_extract(lut[i].red, 16)); I915_WRITE(PREC_PAL_GC_MAX(pipe, 1),