From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Maarten Lankhorst <maarten.lankhorst@linux.intel.com>,
Martin Peres <martin.peres@linux.intel.com>,
Shashank Sharma <shashank.sharma@intel.com>,
Kiran S Kumar <kiran.s.kumar@intel.com>,
Kausal Malladi <kausalmalladi@gmail.com>,
Lionel Landwerlin <lionel.g.landwerlin@intel.com>,
Matt Roper <matthew.d.roper@intel.com>,
Daniel Vetter <daniel.vetter@intel.com>,
Jani Nikula <jani.nikula@linux.intel.com>,
intel-gfx@lists.freedesktop.org,
Jani Nikula <jani.nikula@intel.com>
Subject: [PATCH 4.12 23/65] drm/i915: Fix out-of-bounds array access in bdw_load_gamma_lut
Date: Mon, 14 Aug 2017 18:19:14 -0700 [thread overview]
Message-ID: <20170815011943.314063116@linuxfoundation.org> (raw)
In-Reply-To: <20170815011942.395714306@linuxfoundation.org>
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
commit 5279fc7724ae3a82c9cfe5b09c1fb07ff0e41056 upstream.
bdw_load_gamma_lut is writing beyond the array to the maximum value.
The intend of the function is to clamp values > 1 to 1, so write
the intended color to the max register.
This fixes the following KASAN warning:
[ 197.020857] [IGT] kms_pipe_color: executing
[ 197.063434] [IGT] kms_pipe_color: starting subtest ctm-0-25-pipe0
[ 197.078989] ==================================================================
[ 197.079127] BUG: KASAN: slab-out-of-bounds in bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915]
[ 197.079188] Read of size 2 at addr ffff8800d38db150 by task kms_pipe_color/1839
[ 197.079208] CPU: 2 PID: 1839 Comm: kms_pipe_color Tainted: G U 4.13.0-rc1-patser+ #5211
[ 197.079215] Hardware name: NUC5i7RYB, BIOS RYBDWi35.86A.0246.2015.0309.1355 03/09/2015
[ 197.079220] Call Trace:
[ 197.079230] dump_stack+0x68/0x9e
[ 197.079239] print_address_description+0x6f/0x250
[ 197.079251] kasan_report+0x216/0x370
[ 197.079374] ? bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915]
[ 197.079451] ? gen8_write16+0x4e0/0x4e0 [i915]
[ 197.079460] __asan_report_load2_noabort+0x14/0x20
[ 197.079535] bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915]
[ 197.079612] broadwell_load_luts+0x1df/0x550 [i915]
[ 197.079690] intel_color_load_luts+0x7b/0x80 [i915]
[ 197.079764] intel_begin_crtc_commit+0x138/0x760 [i915]
[ 197.079783] drm_atomic_helper_commit_planes_on_crtc+0x1a3/0x820 [drm_kms_helper]
[ 197.079859] ? intel_pre_plane_update+0x571/0x580 [i915]
[ 197.079937] intel_update_crtc+0x238/0x330 [i915]
[ 197.080016] intel_update_crtcs+0x10f/0x210 [i915]
[ 197.080092] intel_atomic_commit_tail+0x1552/0x3340 [i915]
[ 197.080101] ? _raw_spin_unlock+0x3c/0x40
[ 197.080110] ? __queue_work+0xb40/0xbf0
[ 197.080188] ? skl_update_crtcs+0xc00/0xc00 [i915]
[ 197.080195] ? trace_hardirqs_on+0xd/0x10
[ 197.080269] ? intel_atomic_commit_ready+0x128/0x13c [i915]
[ 197.080329] ? __i915_sw_fence_complete+0x5b8/0x6d0 [i915]
[ 197.080336] ? debug_object_activate+0x39e/0x580
[ 197.080397] ? i915_sw_fence_await+0x30/0x30 [i915]
[ 197.080409] ? __might_sleep+0x15b/0x180
[ 197.080483] intel_atomic_commit+0x944/0xa70 [i915]
[ 197.080490] ? refcount_dec_and_test+0x11/0x20
[ 197.080567] ? intel_atomic_commit_tail+0x3340/0x3340 [i915]
[ 197.080597] ? drm_atomic_crtc_set_property+0x303/0x580 [drm]
[ 197.080674] ? intel_atomic_commit_tail+0x3340/0x3340 [i915]
[ 197.080704] drm_atomic_commit+0xd7/0xe0 [drm]
[ 197.080722] drm_atomic_helper_crtc_set_property+0xec/0x130 [drm_kms_helper]
[ 197.080749] drm_mode_crtc_set_obj_prop+0x7d/0xb0 [drm]
[ 197.080775] drm_mode_obj_set_property_ioctl+0x50b/0x5d0 [drm]
[ 197.080783] ? __might_fault+0x104/0x180
[ 197.080809] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm]
[ 197.080838] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm]
[ 197.080861] drm_ioctl_kernel+0x154/0x1a0 [drm]
[ 197.080885] drm_ioctl+0x624/0x8f0 [drm]
[ 197.080910] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm]
[ 197.080934] ? drm_getunique+0x210/0x210 [drm]
[ 197.080943] ? __handle_mm_fault+0x1bd0/0x1ce0
[ 197.080949] ? lock_downgrade+0x610/0x610
[ 197.080957] ? __lru_cache_add+0x15a/0x180
[ 197.080967] do_vfs_ioctl+0xd92/0xe40
[ 197.080975] ? ioctl_preallocate+0x1b0/0x1b0
[ 197.080982] ? selinux_capable+0x20/0x20
[ 197.080991] ? __do_page_fault+0x7b7/0x9a0
[ 197.080997] ? lock_downgrade+0x5bb/0x610
[ 197.081007] ? security_file_ioctl+0x57/0x90
[ 197.081016] SyS_ioctl+0x4e/0x80
[ 197.081024] entry_SYSCALL_64_fastpath+0x18/0xad
[ 197.081030] RIP: 0033:0x7f61f287a987
[ 197.081035] RSP: 002b:00007fff7d44d188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 197.081043] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f61f287a987
[ 197.081048] RDX: 00007fff7d44d1c0 RSI: 00000000c01864ba RDI: 0000000000000003
[ 197.081053] RBP: 00007f61f2b3eb00 R08: 0000000000000059 R09: 0000000000000000
[ 197.081058] R10: 0000002ea5c4a290 R11: 0000000000000246 R12: 00007f61f2b3eb58
[ 197.081063] R13: 0000000000001010 R14: 00007f61f2b3eb58 R15: 0000000000002702
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101659
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Reported-by: Martin Peres <martin.peres@linux.intel.com>
Cc: Martin Peres <martin.peres@linux.intel.com>
Fixes: 82cf435b3134 ("drm/i915: Implement color management on bdw/skl/bxt/kbl")
Cc: Shashank Sharma <shashank.sharma@intel.com>
Cc: Kiran S Kumar <kiran.s.kumar@intel.com>
Cc: Kausal Malladi <kausalmalladi@gmail.com>
Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: intel-gfx@lists.freedesktop.org
Link: https://patchwork.freedesktop.org/patch/msgid/20170724091431.24251-1-maarten.lankhorst@linux.intel.com
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
(cherry picked from commit 09a92bc8773b4314e02b478e003fe5936ce85adb)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_color.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/i915/intel_color.c
+++ b/drivers/gpu/drm/i915/intel_color.c
@@ -398,6 +398,7 @@ static void bdw_load_gamma_lut(struct dr
}
/* Program the max register to clamp values > 1.0. */
+ i = lut_size - 1;
I915_WRITE(PREC_PAL_GC_MAX(pipe, 0),
drm_color_lut_extract(lut[i].red, 16));
I915_WRITE(PREC_PAL_GC_MAX(pipe, 1),
next prev parent reply other threads:[~2017-08-15 1:33 UTC|newest]
Thread overview: 76+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-15 1:18 [PATCH 4.12 00/65] 4.12.8-stable review Greg Kroah-Hartman
2017-08-15 1:18 ` [PATCH 4.12 01/65] mm: ratelimit PFNs busy info message Greg Kroah-Hartman
2017-08-15 1:18 ` [PATCH 4.12 02/65] mm: fix list corruptions on shmem shrinklist Greg Kroah-Hartman
2017-08-15 1:18 ` [PATCH 4.12 03/65] futex: Remove unnecessary warning from get_futex_key Greg Kroah-Hartman
2017-08-15 1:18 ` [PATCH 4.12 04/65] xtensa: fix cache aliasing handling code for WT cache Greg Kroah-Hartman
2017-08-15 1:18 ` [PATCH 4.12 05/65] xtensa: mm/cache: add missing EXPORT_SYMBOLs Greg Kroah-Hartman
2017-08-15 1:18 ` [PATCH 4.12 06/65] xtensa: dont limit csum_partial export by CONFIG_NET Greg Kroah-Hartman
2017-08-15 1:18 ` [PATCH 4.12 07/65] xfs: Fix leak of discard bio Greg Kroah-Hartman
2017-08-15 1:18 ` [PATCH 4.12 08/65] pinctrl: armada-37xx: Fix number of pin in south bridge Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 09/65] mtd: nand: atmel: Fix DT backward compatibility in pmecc.c Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 10/65] mtd: nand: Fix timing setup for NANDs that do not support SET FEATURES Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 11/65] mtd: nand: Declare tBERS, tR and tPROG as u64 to avoid integer overflow Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 12/65] iscsi-target: fix memory leak in iscsit_setup_text_cmd() Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 13/65] iscsi-target: Fix iscsi_np reset hung task during parallel delete Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 14/65] usb-storage: fix deadlock involving host lock and scsi_done Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 15/65] target: Fix node_acl demo-mode + uncached dynamic shutdown regression Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 16/65] fuse: initialize the flock flag in fuse_file on allocation Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 17/65] i2c: designware: Some broken DSTDs use 1MiHz instead of 1MHz Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 18/65] nand: fix wrong default oob layout for small pages using soft ecc Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 19/65] mmc: mmc: correct the logic for setting HS400ES signal voltage Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 20/65] nfs/flexfiles: fix leak of nfs4_ff_ds_version arrays Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 21/65] drm/bridge: tc358767: fix probe without attached output node Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 22/65] drm/etnaviv: Fix off-by-one error in reloc checking Greg Kroah-Hartman
2017-08-15 1:19 ` Greg Kroah-Hartman [this message]
2017-08-15 1:19 ` [PATCH 4.12 24/65] USB: serial: option: add D-Link DWM-222 device ID Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 25/65] USB: serial: cp210x: add support for Qivicon USB ZigBee dongle Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 26/65] USB: serial: pl2303: add new ATEN device id Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 27/65] usb: musb: fix tx fifo flush handling again Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 28/65] USB: hcd: Mark secondary HCD as dead if the primary one died Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 29/65] staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 30/65] iio: aspeed-adc: wait for initial sequence Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 31/65] iio: accel: st_accel: add SPI-3wire support Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 32/65] iio: accel: bmc150: Always restore device to normal mode after suspend-resume Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 33/65] iio: pressure: st_pressure_core: disable multiread by default for LPS22HB Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 34/65] iio: light: tsl2563: use correct event code Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 35/65] iio: adc: Revert "axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications" Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 36/65] staging: comedi: comedi_fops: do not call blocking ops when !TASK_RUNNING Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 37/65] uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069 Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 38/65] firmware: fix batched requests - wake all waiters Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 39/65] firmware: fix batched requests - send wake up on failure on direct lookups Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 40/65] firmware: avoid invalid fallback aborts by using killable wait Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 41/65] block: Make blk_mq_delay_kick_requeue_list() rerun the queue at a quiet time Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 42/65] usb: gadget: udc: renesas_usb3: Fix usb_gadget_giveback_request() calling Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 43/65] usb: renesas_usbhs: Fix UGCTRL2 value for R-Car Gen3 Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 44/65] USB: Check for dropped connection before switching to full speed Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 45/65] usb: core: unlink urbs from the tail of the endpoints urb_list Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 46/65] usb: quirks: Add no-lpm quirk for Moshi USB to Ethernet Adapter Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 47/65] usb:xhci:Add quirk for Certain failing HP keyboard on reset after resume Greg Kroah-Hartman
2017-08-18 20:02 ` Ben Hutchings
2017-08-18 22:50 ` Greg Kroah-Hartman
2017-08-21 9:55 ` Sandeep Singh
2017-08-15 1:19 ` [PATCH 4.12 48/65] PCI: Protect pci_error_handlers->reset_notify() usage with device_lock() Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 49/65] PCI: Remove __pci_dev_reset() and pci_dev_reset() Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 50/65] PCI: Add pci_reset_function_locked() Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 51/65] xhci: Reset Renesas uPD72020x USB controller for 32-bit DMA issue Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 52/65] iio: adc: vf610_adc: Fix VALT selection value for REFSEL bits Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 53/65] pnfs/blocklayout: require 64-bit sector_t Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 54/65] pinctrl: cherryview: Add Setzer models to the Chromebook DMI quirk Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 55/65] pinctrl: sunxi: add a missing function of A10/A20 pinctrl driver Greg Kroah-Hartman
2017-08-18 20:07 ` Ben Hutchings
2017-08-22 9:11 ` Chen-Yu Tsai
2017-08-22 15:51 ` Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 56/65] pinctrl: intel: merrifield: Correct UART pin lists Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 57/65] pinctrl: uniphier: fix WARN_ON() of pingroups dump on LD11 Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 58/65] pinctrl: uniphier: fix WARN_ON() of pingroups dump on LD20 Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 59/65] pinctrl: samsung: Remove bogus irq_[un]mask from resource management Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 60/65] pinctrl: meson-gxbb: Add missing GPIODV_18 pin entry Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 61/65] pinctrl: meson-gxl: " Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 62/65] MIPS: DEC: Fix an int-handler.S CPU_DADDI_WORKAROUNDS regression Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 63/65] Revert "MIPS: Dont unnecessarily include kmalloc.h into <asm/cache.h>." Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 64/65] MIPS: Octeon: Fix broken EDAC driver Greg Kroah-Hartman
2017-08-15 1:19 ` [PATCH 4.12 65/65] powerpc: Fix /proc/cpuinfo revision for POWER9 DD2 Greg Kroah-Hartman
2017-08-15 10:45 ` [PATCH 4.12 00/65] 4.12.8-stable review Guenter Roeck
2017-08-15 14:34 ` Greg Kroah-Hartman
2017-08-15 18:09 ` Shuah Khan
2017-08-15 18:10 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170815011943.314063116@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=daniel.vetter@intel.com \
--cc=intel-gfx@lists.freedesktop.org \
--cc=jani.nikula@intel.com \
--cc=jani.nikula@linux.intel.com \
--cc=kausalmalladi@gmail.com \
--cc=kiran.s.kumar@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lionel.g.landwerlin@intel.com \
--cc=maarten.lankhorst@linux.intel.com \
--cc=martin.peres@linux.intel.com \
--cc=matthew.d.roper@intel.com \
--cc=shashank.sharma@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).