diff for duplicates of <f5b597e94de9150ba96e32cc9764bc09b2c298de.camel@mediatek.com> diff --git a/a/1.txt b/N1/1.txt index 6bb90a1..78e777b 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -74,3 +74,7 @@ Reviewed-by: CK Hu <ck.hu@mediatek.com> > > -- > 2.44.0.396.g6e790dbe36-goog +_______________________________________________ +linux-arm-kernel mailing list +linux-arm-kernel@lists.infradead.org +http://lists.infradead.org/mailman/listinfo/linux-arm-kernel diff --git a/a/content_digest b/N1/content_digest index 30ea2c0..06fbf5c 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -92,6 +92,10 @@ "> \t\treturn -ENOMEM;\n" "> \n" "> -- \n" - > 2.44.0.396.g6e790dbe36-goog + "> 2.44.0.396.g6e790dbe36-goog\n" + "_______________________________________________\n" + "linux-arm-kernel mailing list\n" + "linux-arm-kernel@lists.infradead.org\n" + http://lists.infradead.org/mailman/listinfo/linux-arm-kernel -4172bf37a74c91892e0b0c0e9232b9050549c67629f72dc32096e9e63a6ee05a +dd9921e9f0d06a4df20ac4524cb377ec01cffcfc5d1d83eb01b87a90b48b1319
diff --git a/N2/2.bin b/N2/2.bin new file mode 100644 index 0000000..b5b42d8 --- /dev/null +++ b/N2/2.bin @@ -0,0 +1,93 @@ +<html><body><p> +<pre> +Hi, Douglas: + +On Thu, 2024-03-28 at 09:22 -0700, Douglas Anderson wrote: +>    +> External email : Please do not click links or open attachments until +> you have verified the sender or the content. +>  In the case where `conn_routes` is true we allocate an extra slot in +> the `ddp_comp` array but mtk_drm_crtc_create() never seemed to +> initialize it in the test case I ran. For me, this caused a later +> crash when we looped through the array in mtk_drm_crtc_mode_valid(). +> This showed up for me when I booted with `slub_debug=FZPUA` which +> poisons the memory initially. Without `slub_debug` I couldn't +> reproduce, presumably because the later code handles the value being +> NULL and in most cases (not guaranteed in all cases) the memory the +> allocator returned started out as 0. +>  +> It really doesn't hurt to initialize the array with devm_kcalloc() +> since the array is small and the overhead of initting a handful of +> elements to 0 is small. In general initting memory to zero is a safer +> practice and usually it's suggested to only use the non-initting +> alloc +> functions if you really need to. +>  +> Let's switch the function to use an allocation function that zeros +> the +> memory. For me, this avoids the crash. + +Reviewed-by: CK Hu <ck.hu@mediatek.com> + +>  +> Fixes: 01389b324c97 ("drm/mediatek: Add connector dynamic selection +> capability") +> Signed-off-by: Douglas Anderson <dianders@chromium.org> +> --- +> I don't have a ton of experience with this driver to know if the fact +> that the array item was still uninitialized when +> mtk_drm_crtc_mode_valid() ran is the sign of a bug that should be +> fixed. However, even if it is a bug and that bug is fixed then +> zeroing +> memory when we allocate is still safer. If it's a bug that this +> memory +> wasn't initialized then please consider this patch a bug report. ;-) +>  +> I'll also note that I reproduced this on a downstream 6.1-based +> kernel. It appears that only mt8188 uses `conn_routes` and, as far as +> I can tell, mt8188 isn't supported upstream yet. +>  +>  drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 8 ++++---- +>  1 file changed, 4 insertions(+), 4 deletions(-) +>  +> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +> b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +> index a04499c4f9ca..29207b2756c1 100644 +> --- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +> +++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +> @@ -1009,10 +1009,10 @@ int mtk_drm_crtc_create(struct drm_device +> *drm_dev, +>   +>  mtk_crtc->mmsys_dev = priv->mmsys_dev; +>  mtk_crtc->ddp_comp_nr = path_len; +> -mtk_crtc->ddp_comp = devm_kmalloc_array(dev, +> -mtk_crtc->ddp_comp_nr + +> (conn_routes ? 1 : 0), +> -sizeof(*mtk_crtc- +> >ddp_comp), +> -GFP_KERNEL); +> +mtk_crtc->ddp_comp = devm_kcalloc(dev, +> +  mtk_crtc->ddp_comp_nr + +> (conn_routes ? 1 : 0), +> +  sizeof(*mtk_crtc->ddp_comp), +> +  GFP_KERNEL); +>  if (!mtk_crtc->ddp_comp) +>  return -ENOMEM; +>   +> --  +> 2.44.0.396.g6e790dbe36-goog + +</pre> +</p></body></html><!--type:text--><!--{--><pre>************* MEDIATEK Confidentiality Notice ******************** +The information contained in this e-mail message (including any +attachments) may be confidential, proprietary, privileged, or otherwise +exempt from disclosure under applicable laws. It is intended to be +conveyed only to the designated recipient(s). Any use, dissemination, +distribution, printing, retaining or copying of this e-mail (including its +attachments) by unintended recipient(s) is strictly prohibited and may +be unlawful. If you are not an intended recipient of this e-mail, or believe +that you have received this e-mail in error, please notify the sender +immediately (by replying to this e-mail), delete any and all copies of +this e-mail (including any attachments) from your system, and do not +disclose the content of this e-mail to any other person. Thank you! +</pre><!--}--> diff --git a/N2/2.hdr b/N2/2.hdr new file mode 100644 index 0000000..da1f671 --- /dev/null +++ b/N2/2.hdr @@ -0,0 +1,3 @@ +Content-Type: text/html; + charset="utf-8" +Content-Transfer-Encoding: base64 diff --git a/a/content_digest b/N2/content_digest index 30ea2c0..f436089 100644 --- a/a/content_digest +++ b/N2/content_digest @@ -15,7 +15,7 @@ linux-arm-kernel@lists.infradead.org <linux-arm-kernel@lists.infradead.org> matthias.bgg@gmail.com <matthias.bgg@gmail.com> " angelogioacchino.delregno@collabora.com <angelogioacchino.delregno@collabora.com>\0" - "\00:1\0" + "\01:1\0" "b\0" "Hi, Douglas:\n" "\n" @@ -93,5 +93,100 @@ "> \n" "> -- \n" > 2.44.0.396.g6e790dbe36-goog + "\01:2\0" + "b\0" + "<html><body><p>\r\n" + "<pre>\r\n" + "Hi, Douglas:\r\n" + "\r\n" + "On Thu, 2024-03-28 at 09:22 -0700, Douglas Anderson wrote:\r\n" + ">   \r\n" + "> External email : Please do not click links or open attachments until\r\n" + "> you have verified the sender or the content.\r\n" + ">  In the case where `conn_routes` is true we allocate an extra slot in\r\n" + "> the `ddp_comp` array but mtk_drm_crtc_create() never seemed to\r\n" + "> initialize it in the test case I ran. For me, this caused a later\r\n" + "> crash when we looped through the array in mtk_drm_crtc_mode_valid().\r\n" + "> This showed up for me when I booted with `slub_debug=FZPUA` which\r\n" + "> poisons the memory initially. Without `slub_debug` I couldn't\r\n" + "> reproduce, presumably because the later code handles the value being\r\n" + "> NULL and in most cases (not guaranteed in all cases) the memory the\r\n" + "> allocator returned started out as 0.\r\n" + "> \r\n" + "> It really doesn't hurt to initialize the array with devm_kcalloc()\r\n" + "> since the array is small and the overhead of initting a handful of\r\n" + "> elements to 0 is small. In general initting memory to zero is a safer\r\n" + "> practice and usually it's suggested to only use the non-initting\r\n" + "> alloc\r\n" + "> functions if you really need to.\r\n" + "> \r\n" + "> Let's switch the function to use an allocation function that zeros\r\n" + "> the\r\n" + "> memory. For me, this avoids the crash.\r\n" + "\r\n" + "Reviewed-by: CK Hu <ck.hu@mediatek.com>\r\n" + "\r\n" + "> \r\n" + "> Fixes: 01389b324c97 ("drm/mediatek: Add connector dynamic selection\r\n" + "> capability")\r\n" + "> Signed-off-by: Douglas Anderson <dianders@chromium.org>\r\n" + "> ---\r\n" + "> I don't have a ton of experience with this driver to know if the fact\r\n" + "> that the array item was still uninitialized when\r\n" + "> mtk_drm_crtc_mode_valid() ran is the sign of a bug that should be\r\n" + "> fixed. However, even if it is a bug and that bug is fixed then\r\n" + "> zeroing\r\n" + "> memory when we allocate is still safer. If it's a bug that this\r\n" + "> memory\r\n" + "> wasn't initialized then please consider this patch a bug report. ;-)\r\n" + "> \r\n" + "> I'll also note that I reproduced this on a downstream 6.1-based\r\n" + "> kernel. It appears that only mt8188 uses `conn_routes` and, as far as\r\n" + "> I can tell, mt8188 isn't supported upstream yet.\r\n" + "> \r\n" + ">  drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 8 ++++----\r\n" + ">  1 file changed, 4 insertions(+), 4 deletions(-)\r\n" + "> \r\n" + "> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c\r\n" + "> b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c\r\n" + "> index a04499c4f9ca..29207b2756c1 100644\r\n" + "> --- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c\r\n" + "> +++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c\r\n" + "> @@ -1009,10 +1009,10 @@ int mtk_drm_crtc_create(struct drm_device\r\n" + "> *drm_dev,\r\n" + ">  \r\n" + ">  mtk_crtc->mmsys_dev = priv->mmsys_dev;\r\n" + ">  mtk_crtc->ddp_comp_nr = path_len;\r\n" + "> -mtk_crtc->ddp_comp = devm_kmalloc_array(dev,\r\n" + "> -mtk_crtc->ddp_comp_nr +\r\n" + "> (conn_routes ? 1 : 0),\r\n" + "> -sizeof(*mtk_crtc-\r\n" + "> >ddp_comp),\r\n" + "> -GFP_KERNEL);\r\n" + "> +mtk_crtc->ddp_comp = devm_kcalloc(dev,\r\n" + "> +  mtk_crtc->ddp_comp_nr +\r\n" + "> (conn_routes ? 1 : 0),\r\n" + "> +  sizeof(*mtk_crtc->ddp_comp),\r\n" + "> +  GFP_KERNEL);\r\n" + ">  if (!mtk_crtc->ddp_comp)\r\n" + ">  return -ENOMEM;\r\n" + ">  \r\n" + "> -- \r\n" + "> 2.44.0.396.g6e790dbe36-goog\r\n" + "\r\n" + "</pre>\r\n" + "</p></body></html><!--type:text--><!--{--><pre>************* MEDIATEK Confidentiality Notice ********************\r\n" + "The information contained in this e-mail message (including any \r\n" + "attachments) may be confidential, proprietary, privileged, or otherwise\r\n" + "exempt from disclosure under applicable laws. It is intended to be \r\n" + "conveyed only to the designated recipient(s). Any use, dissemination, \r\n" + "distribution, printing, retaining or copying of this e-mail (including its \r\n" + "attachments) by unintended recipient(s) is strictly prohibited and may \r\n" + "be unlawful. If you are not an intended recipient of this e-mail, or believe \r\n" + "that you have received this e-mail in error, please notify the sender \r\n" + "immediately (by replying to this e-mail), delete any and all copies of \r\n" + "this e-mail (including any attachments) from your system, and do not\r\n" + "disclose the content of this e-mail to any other person. Thank you!\r\n" + </pre><!--}--> -4172bf37a74c91892e0b0c0e9232b9050549c67629f72dc32096e9e63a6ee05a +86a4cf7309d9f12145b2ab9830c1459c82b56e3140aca9f256fbc785db468b26
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.