From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rob Clark Subject: [PATCH] drm/vmwgfx: fix memory corruption with legacy/sou connectors Date: Wed, 17 Jan 2018 10:16:20 -0500 Message-ID: <20180117151629.27423-1-robdclark@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mail-qk0-x244.google.com (mail-qk0-x244.google.com [IPv6:2607:f8b0:400d:c09::244]) by gabe.freedesktop.org (Postfix) with ESMTPS id AF1BB6E4A3 for ; Wed, 17 Jan 2018 15:16:34 +0000 (UTC) Received: by mail-qk0-x244.google.com with SMTP id y80so19053030qkb.4 for ; Wed, 17 Jan 2018 07:16:34 -0800 (PST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org Cc: Thomas Hellstrom , Rob Clark , David Airlie , linux-kernel@vger.kernel.org, stable@vger.kernel.org, VMware Graphics List-Id: dri-devel@lists.freedesktop.org RnJvbTogUm9iIENsYXJrIDxyY2xhcmtAcmVkaGF0LmNvbT4KCkl0IGxvb2tzIGxpa2UgaW4gYWxs IGNhc2VzICdzdHJ1Y3Qgdm13X2Nvbm5lY3Rvcl9zdGF0ZScgaXMgdXNlZC4gIEJ1dApvbmx5IGlu IHN0ZHUgY29ubmVjdG9ycywgd2FzIGF0b21pY197ZHVwbGljYXRlLGRlc3Ryb3l9X3N0YXRlKCkg cHJvcGVybHkKc3ViY2xhc3NlZC4gIExlYWRpbmcgdG8gd3JpdGVzIGJleW9uZCB0aGUgZW5kIG9m IHRoZSBhbGxvY2F0ZWQgY29ubmVjdG9yCnN0YXRlIGJsb2NrIGFuZCBhbGwgc29ydHMgb2YgZnVu IG1lbW9yeSBjb3JydXB0aW9uIHJlbGF0ZWQgY3Jhc2hlcy4KCkZpeGVzOiBkNzcyMWNhNzExMjYg ImRybS92bXdnZng6IENvbm5lY3RvciBhdG9taWMgc3RhdGUiCkNjOiA8c3RhYmxlQHZnZXIua2Vy bmVsLm9yZz4KU2lnbmVkLW9mZi1ieTogUm9iIENsYXJrIDxyY2xhcmtAcmVkaGF0LmNvbT4KLS0t CiBkcml2ZXJzL2dwdS9kcm0vdm13Z2Z4L3Ztd2dmeF9sZHUuYyAgfCA0ICsrLS0KIGRyaXZlcnMv Z3B1L2RybS92bXdnZngvdm13Z2Z4X3Njcm4uYyB8IDQgKystLQogMiBmaWxlcyBjaGFuZ2VkLCA0 IGluc2VydGlvbnMoKyksIDQgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUv ZHJtL3Ztd2dmeC92bXdnZnhfbGR1LmMgYi9kcml2ZXJzL2dwdS9kcm0vdm13Z2Z4L3Ztd2dmeF9s ZHUuYwppbmRleCBiOGEwOTgwN2M1ZGUuLjM4MjQ1OTVmZWNlMSAxMDA2NDQKLS0tIGEvZHJpdmVy cy9ncHUvZHJtL3Ztd2dmeC92bXdnZnhfbGR1LmMKKysrIGIvZHJpdmVycy9ncHUvZHJtL3Ztd2dm eC92bXdnZnhfbGR1LmMKQEAgLTI2Niw4ICsyNjYsOCBAQCBzdGF0aWMgY29uc3Qgc3RydWN0IGRy bV9jb25uZWN0b3JfZnVuY3Mgdm13X2xlZ2FjeV9jb25uZWN0b3JfZnVuY3MgPSB7CiAJLnNldF9w cm9wZXJ0eSA9IHZtd19kdV9jb25uZWN0b3Jfc2V0X3Byb3BlcnR5LAogCS5kZXN0cm95ID0gdm13 X2xkdV9jb25uZWN0b3JfZGVzdHJveSwKIAkucmVzZXQgPSB2bXdfZHVfY29ubmVjdG9yX3Jlc2V0 LAotCS5hdG9taWNfZHVwbGljYXRlX3N0YXRlID0gZHJtX2F0b21pY19oZWxwZXJfY29ubmVjdG9y X2R1cGxpY2F0ZV9zdGF0ZSwKLQkuYXRvbWljX2Rlc3Ryb3lfc3RhdGUgPSBkcm1fYXRvbWljX2hl bHBlcl9jb25uZWN0b3JfZGVzdHJveV9zdGF0ZSwKKwkuYXRvbWljX2R1cGxpY2F0ZV9zdGF0ZSA9 IHZtd19kdV9jb25uZWN0b3JfZHVwbGljYXRlX3N0YXRlLAorCS5hdG9taWNfZGVzdHJveV9zdGF0 ZSA9IHZtd19kdV9jb25uZWN0b3JfZGVzdHJveV9zdGF0ZSwKIAkuYXRvbWljX3NldF9wcm9wZXJ0 eSA9IHZtd19kdV9jb25uZWN0b3JfYXRvbWljX3NldF9wcm9wZXJ0eSwKIAkuYXRvbWljX2dldF9w cm9wZXJ0eSA9IHZtd19kdV9jb25uZWN0b3JfYXRvbWljX2dldF9wcm9wZXJ0eSwKIH07CmRpZmYg LS1naXQgYS9kcml2ZXJzL2dwdS9kcm0vdm13Z2Z4L3Ztd2dmeF9zY3JuLmMgYi9kcml2ZXJzL2dw dS9kcm0vdm13Z2Z4L3Ztd2dmeF9zY3JuLmMKaW5kZXggYmM1ZjYwMjY1NzNkLi42M2E0Y2Q3OTRi NzMgMTAwNjQ0Ci0tLSBhL2RyaXZlcnMvZ3B1L2RybS92bXdnZngvdm13Z2Z4X3Njcm4uYworKysg Yi9kcml2ZXJzL2dwdS9kcm0vdm13Z2Z4L3Ztd2dmeF9zY3JuLmMKQEAgLTQyMCw4ICs0MjAsOCBA QCBzdGF0aWMgY29uc3Qgc3RydWN0IGRybV9jb25uZWN0b3JfZnVuY3Mgdm13X3NvdV9jb25uZWN0 b3JfZnVuY3MgPSB7CiAJLnNldF9wcm9wZXJ0eSA9IHZtd19kdV9jb25uZWN0b3Jfc2V0X3Byb3Bl cnR5LAogCS5kZXN0cm95ID0gdm13X3NvdV9jb25uZWN0b3JfZGVzdHJveSwKIAkucmVzZXQgPSB2 bXdfZHVfY29ubmVjdG9yX3Jlc2V0LAotCS5hdG9taWNfZHVwbGljYXRlX3N0YXRlID0gZHJtX2F0 b21pY19oZWxwZXJfY29ubmVjdG9yX2R1cGxpY2F0ZV9zdGF0ZSwKLQkuYXRvbWljX2Rlc3Ryb3lf c3RhdGUgPSBkcm1fYXRvbWljX2hlbHBlcl9jb25uZWN0b3JfZGVzdHJveV9zdGF0ZSwKKwkuYXRv bWljX2R1cGxpY2F0ZV9zdGF0ZSA9IHZtd19kdV9jb25uZWN0b3JfZHVwbGljYXRlX3N0YXRlLAor CS5hdG9taWNfZGVzdHJveV9zdGF0ZSA9IHZtd19kdV9jb25uZWN0b3JfZGVzdHJveV9zdGF0ZSwK IAkuYXRvbWljX3NldF9wcm9wZXJ0eSA9IHZtd19kdV9jb25uZWN0b3JfYXRvbWljX3NldF9wcm9w ZXJ0eSwKIAkuYXRvbWljX2dldF9wcm9wZXJ0eSA9IHZtd19kdV9jb25uZWN0b3JfYXRvbWljX2dl dF9wcm9wZXJ0eSwKIH07Ci0tIAoyLjE0LjMKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fCmRyaS1kZXZlbCBtYWlsaW5nIGxpc3QKZHJpLWRldmVsQGxpc3Rz LmZyZWVkZXNrdG9wLm9yZwpodHRwczovL2xpc3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2RyaS1kZXZlbAo= From mboxrd@z Thu Jan 1 00:00:00 1970 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753767AbeAQPQj (ORCPT + 1 other); Wed, 17 Jan 2018 10:16:39 -0500 Received: from mail-qk0-f195.google.com ([209.85.220.195]:46711 "EHLO mail-qk0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753575AbeAQPQe (ORCPT ); Wed, 17 Jan 2018 10:16:34 -0500 X-Google-Smtp-Source: ACJfBovZ92DatY5Azb5DFaJSqPjJU8YDDWDMsuhTepdo/gvsLIKVxXkRM6HUx16xRt/XuQflvanbkw== From: Rob Clark To: dri-devel@lists.freedesktop.org Cc: Rob Clark , stable@vger.kernel.org, VMware Graphics , Sinclair Yeh , Thomas Hellstrom , David Airlie , linux-kernel@vger.kernel.org Subject: [PATCH] drm/vmwgfx: fix memory corruption with legacy/sou connectors Date: Wed, 17 Jan 2018 10:16:20 -0500 Message-Id: <20180117151629.27423-1-robdclark@gmail.com> X-Mailer: git-send-email 2.14.3 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: From: Rob Clark It looks like in all cases 'struct vmw_connector_state' is used. But only in stdu connectors, was atomic_{duplicate,destroy}_state() properly subclassed. Leading to writes beyond the end of the allocated connector state block and all sorts of fun memory corruption related crashes. Fixes: d7721ca71126 "drm/vmwgfx: Connector atomic state" Cc: Signed-off-by: Rob Clark --- drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c | 4 ++-- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c index b8a09807c5de..3824595fece1 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c @@ -266,8 +266,8 @@ static const struct drm_connector_funcs vmw_legacy_connector_funcs = { .set_property = vmw_du_connector_set_property, .destroy = vmw_ldu_connector_destroy, .reset = vmw_du_connector_reset, - .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state, - .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, + .atomic_duplicate_state = vmw_du_connector_duplicate_state, + .atomic_destroy_state = vmw_du_connector_destroy_state, .atomic_set_property = vmw_du_connector_atomic_set_property, .atomic_get_property = vmw_du_connector_atomic_get_property, }; diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c index bc5f6026573d..63a4cd794b73 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c @@ -420,8 +420,8 @@ static const struct drm_connector_funcs vmw_sou_connector_funcs = { .set_property = vmw_du_connector_set_property, .destroy = vmw_sou_connector_destroy, .reset = vmw_du_connector_reset, - .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state, - .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, + .atomic_duplicate_state = vmw_du_connector_duplicate_state, + .atomic_destroy_state = vmw_du_connector_destroy_state, .atomic_set_property = vmw_du_connector_atomic_set_property, .atomic_get_property = vmw_du_connector_atomic_get_property, }; -- 2.14.3