mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-28 11:18:45 +07:00
06ad8d3395
The gma500 driver expects 3 pipelines in several it's IRQ functions.
Accessing struct drm_device.vblank[], this fails with devices that only
have 2 pipelines. An example KASAN report is shown below.
[ 62.267688] ==================================================================
[ 62.268856] BUG: KASAN: slab-out-of-bounds in psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
[ 62.269450] Read of size 1 at addr ffff8880012bc6d0 by task systemd-udevd/285
[ 62.269949]
[ 62.270192] CPU: 0 PID: 285 Comm: systemd-udevd Tainted: G E 5.10.0-rc1-1-default+ #572
[ 62.270807] Hardware name: /DN2800MT, BIOS MTCDT10N.86A.0164.2012.1213.1024 12/13/2012
[ 62.271366] Call Trace:
[ 62.271705] dump_stack+0xae/0xe5
[ 62.272180] print_address_description.constprop.0+0x17/0xf0
[ 62.272987] ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
[ 62.273474] __kasan_report.cold+0x20/0x38
[ 62.273989] ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
[ 62.274460] kasan_report+0x3a/0x50
[ 62.274891] psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
[ 62.275380] drm_irq_install+0x131/0x1f0
<...>
[ 62.300751] Allocated by task 285:
[ 62.301223] kasan_save_stack+0x1b/0x40
[ 62.301731] __kasan_kmalloc.constprop.0+0xbf/0xd0
[ 62.302293] drmm_kmalloc+0x55/0x100
[ 62.302773] drm_vblank_init+0x77/0x210
Resolve the issue by only handling vblank entries up to the number of
CRTCs.
I'm adding a Fixes tag for reference, although the bug has been present
since the driver's initial commit.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Fixes:
|
||
---|---|---|
.. | ||
accel_2d.c | ||
backlight.c | ||
blitter.c | ||
blitter.h | ||
cdv_device.c | ||
cdv_device.h | ||
cdv_intel_crt.c | ||
cdv_intel_display.c | ||
cdv_intel_dp.c | ||
cdv_intel_hdmi.c | ||
cdv_intel_lvds.c | ||
framebuffer.c | ||
framebuffer.h | ||
gem.c | ||
gem.h | ||
gma_device.c | ||
gma_device.h | ||
gma_display.c | ||
gma_display.h | ||
gtt.c | ||
gtt.h | ||
intel_bios.c | ||
intel_bios.h | ||
intel_gmbus.c | ||
intel_i2c.c | ||
Kconfig | ||
Makefile | ||
mdfld_device.c | ||
mdfld_dsi_dpi.c | ||
mdfld_dsi_dpi.h | ||
mdfld_dsi_output.c | ||
mdfld_dsi_output.h | ||
mdfld_dsi_pkg_sender.c | ||
mdfld_dsi_pkg_sender.h | ||
mdfld_intel_display.c | ||
mdfld_output.c | ||
mdfld_output.h | ||
mdfld_tmd_vid.c | ||
mdfld_tpo_vid.c | ||
mid_bios.c | ||
mid_bios.h | ||
mmu.c | ||
mmu.h | ||
oaktrail_crtc.c | ||
oaktrail_device.c | ||
oaktrail_hdmi_i2c.c | ||
oaktrail_hdmi.c | ||
oaktrail_lvds_i2c.c | ||
oaktrail_lvds.c | ||
oaktrail.h | ||
opregion.c | ||
opregion.h | ||
power.c | ||
power.h | ||
psb_device.c | ||
psb_device.h | ||
psb_drv.c | ||
psb_drv.h | ||
psb_intel_display.c | ||
psb_intel_drv.h | ||
psb_intel_lvds.c | ||
psb_intel_modes.c | ||
psb_intel_reg.h | ||
psb_intel_sdvo_regs.h | ||
psb_intel_sdvo.c | ||
psb_irq.c | ||
psb_irq.h | ||
psb_lid.c | ||
psb_reg.h | ||
tc35876x-dsi-lvds.c | ||
tc35876x-dsi-lvds.h |