Thomas Zimmermann 0149a4cacc drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] ... commit 06ad8d3395 upstream. The gma500 driver expects 3 pipelines in several it's IRQ functions. Accessing struct drm_device.vblank[], this fails with devices that only have 2 pipelines. An example KASAN report is shown below. [ 62.267688] ================================================================== [ 62.268856] BUG: KASAN: slab-out-of-bounds in psb_irq_postinstall+0x250/0x3c0 [gma500_gfx] [ 62.269450] Read of size 1 at addr ffff8880012bc6d0 by task systemd-udevd/285 [ 62.269949] [ 62.270192] CPU: 0 PID: 285 Comm: systemd-udevd Tainted: G E 5.10.0-rc1-1-default+ #572 [ 62.270807] Hardware name: /DN2800MT, BIOS MTCDT10N.86A.0164.2012.1213.1024 12/13/2012 [ 62.271366] Call Trace: [ 62.271705] dump_stack+0xae/0xe5 [ 62.272180] print_address_description.constprop.0+0x17/0xf0 [ 62.272987] ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx] [ 62.273474] __kasan_report.cold+0x20/0x38 [ 62.273989] ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx] [ 62.274460] kasan_report+0x3a/0x50 [ 62.274891] psb_irq_postinstall+0x250/0x3c0 [gma500_gfx] [ 62.275380] drm_irq_install+0x131/0x1f0 <...> [ 62.300751] Allocated by task 285: [ 62.301223] kasan_save_stack+0x1b/0x40 [ 62.301731] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 62.302293] drmm_kmalloc+0x55/0x100 [ 62.302773] drm_vblank_init+0x77/0x210 Resolve the issue by only handling vblank entries up to the number of CRTCs. I'm adding a Fixes tag for reference, although the bug has been present since the driver's initial commit. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Fixes: 5c49fd3aa0 ("gma500: Add the core DRM files and headers") Cc: Alan Cox <alan@linux.intel.com> Cc: Dave Airlie <airlied@redhat.com> Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com> Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org#v3.3+ Link: https://patchwork.freedesktop.org/patch/msgid/20201105190256.3893-1-tzimmermann@suse.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-11-18 19:18:50 +01:00
..
accessibility
acpi	ACPI: NFIT: Fix comparison to '-ENXIO'	2020-11-10 12:36:00 +01:00
amba
android	binder: fix UAF when releasing todo list	2020-10-29 09:54:56 +01:00
ata	ata: sata_nv: Fix retrieving of active qcs	2020-11-05 11:08:38 +01:00
atm	atm: eni: fix the missed pci_disable_device() for eni_init_one()	2020-10-01 13:14:51 +02:00
auxdisplay
base	PM: runtime: Resume the device earlier in __device_release_driver()	2020-11-10 12:36:01 +01:00
bcma
block	nbd: fix a block_device refcount leak in nbd_release	2020-11-18 19:18:47 +01:00
bluetooth	Bluetooth: hci_uart: Cancel init work before unregistering	2020-10-29 09:55:05 +01:00
bus	bus/fsl_mc: Do not rely on caller to provide non NULL mc_io	2020-11-05 11:08:43 +01:00
cdrom
char	tpm_tis: Disable interrupts on ThinkPad T490s	2020-11-18 19:18:46 +01:00
clk	clk: ti: clockdomain: fix static checker warning	2020-11-05 11:08:44 +01:00
clocksource	clocksource/drivers/h8300_timer8: Fix wrong return value in h8300_8timer_init()	2020-10-01 13:14:51 +02:00
connector
cpufreq	acpi-cpufreq: Honor _PSD table setting on new AMD CPUs	2020-11-05 11:08:47 +01:00
cpuidle	cpuidle: Fixup IRQ state	2020-09-09 19:04:23 +02:00
crypto	chelsio/chtls: fix always leaking ctrl_skb	2020-11-10 12:35:54 +01:00
dax
dca
devfreq	PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out	2020-10-01 13:14:26 +02:00
dio
dma	dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status	2020-11-05 11:08:50 +01:00
dma-buf	dma-fence: Serialise signal enabling (dma_fence_enable_sw_signaling)	2020-10-01 13:14:24 +02:00
edac	EDAC/ti: Fix handling of platform_get_irq() error	2020-10-29 09:55:00 +01:00
eisa
extcon	extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()'	2020-06-25 15:33:01 +02:00
firewire
firmware	firmware: arm_sdei: Use cpus_read_lock() to avoid races with cpuhp	2020-10-01 13:14:35 +02:00
fmc
fpga	fpga: dfl: fix bug in port reset handshake	2020-07-29 10:16:48 +02:00
fsi
gnss	gnss: sirf: fix error return code in sirf_probe()	2020-06-22 09:05:28 +02:00
gpio	gpio: pcie-idio-24: Enable PEX8311 interrupts	2020-11-18 19:18:50 +01:00
gpu	drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[]	2020-11-18 19:18:50 +01:00
hid	HID: wacom: Avoid entering wacom_wac_pen_report for pad / battery	2020-11-05 11:08:50 +01:00
hsi
hv	hv_balloon: disable warning when floor reached	2020-11-18 19:18:41 +01:00
hwmon	hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61}	2020-10-29 09:55:02 +01:00
hwspinlock
hwtracing	coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb()	2020-08-19 08:14:58 +02:00
i2c	i2c: imx: Fix external abort on interrupt in exit paths	2020-11-05 11:08:52 +01:00
ide
idle
iio	iio:gyro:itg3200: Fix timestamp alignment and prevent data leak.	2020-11-05 11:08:51 +01:00
infiniband	RDMA/qedr: Fix memory leak in iWARP CM	2020-11-05 11:08:38 +01:00
input	hil/parisc: Disable HIL driver when it gets stuck	2020-11-05 11:08:54 +01:00
iommu	iommu/amd: Increase interrupt remapping table limit to 512 entries	2020-11-18 19:18:45 +01:00
ipack	ipack: tpci200: fix error return code in tpci200_register()	2020-05-27 17:37:43 +02:00
irqchip	irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake	2020-09-03 11:24:29 +02:00
isdn	PCI: add USR vendor id and use it in r8169 and w6692 driver	2020-06-22 09:05:23 +02:00
leds	leds: bcm6328, bcm6358: use devres LED registering function	2020-11-05 11:08:46 +01:00
lightnvm
macintosh	drivers/macintosh: Fix memleak in windfarm_pm112 driver	2020-06-22 09:05:29 +02:00
mailbox	mailbox: avoid timer start from callback	2020-10-30 10:38:21 +01:00
mcb
md	md/raid5: fix oops during stripe resizing	2020-11-05 11:08:45 +01:00
media	media: uvcvideo: Fix uvc_ctrl_fixup_xu_info() not having any effect	2020-11-05 11:08:46 +01:00
memory	memory: emif: Remove bogus debugfs error handling	2020-11-05 11:08:45 +01:00
memstick
message	scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()	2020-11-05 11:08:47 +01:00
mfd	mfd: sprd: Add wakeup capability for PMIC IRQ	2020-11-18 19:18:46 +01:00
misc	mei: protect mei_cl_mtu from null dereference	2020-11-18 19:18:49 +01:00
mmc	mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove	2020-11-18 19:18:50 +01:00
mtd	ubi: check kthread_should_stop() after the setting of task state	2020-11-05 11:08:52 +01:00
mux
net	cosa: Add missing kfree in error path of cosa_write	2020-11-18 19:18:48 +01:00
nfc	NFC: st95hf: Fix memleak in st95hf_in_send_cmd	2020-09-17 13:45:24 +02:00
ntb	NTB: hw: amd: fix an issue about leak system resources	2020-10-30 10:38:25 +01:00
nubus
nvdimm	libnvdimm: Fix endian conversion issues	2020-06-07 13:17:53 +02:00
nvme	nvme-rdma: fix crash when connect rejected	2020-11-05 11:08:45 +01:00
nvmem	nvmem: qfprom: remove incorrect write support	2020-06-10 21:35:00 +02:00
of	of/address: Fix of_node memory leak in of_dma_is_coherent	2020-11-18 19:18:48 +01:00
opp
oprofile
parisc	parisc: mask out enable and reserved bits from sba imask	2020-08-19 08:15:07 +02:00
parport
pci	PCI: iproc: Set affinity mask on MSI interrupts	2020-10-30 10:38:21 +01:00
pcmcia
perf	drivers/perf: xgene_pmu: Fix uninitialized resource struct	2020-10-29 09:55:00 +01:00
phy	phy: samsung: s5pv210-usb2: Add delay after reset	2020-10-01 13:14:44 +02:00
pinctrl	pinctrl: aspeed: Fix GPI only function problem.	2020-11-18 19:18:47 +01:00
platform	platform/x86: mlx-platform: Remove PSU EEPROM configuration	2020-10-29 09:55:14 +01:00
pnp
power	power: supply: test_power: add missing newlines when printing parameters by sysfs	2020-11-05 11:08:43 +01:00
powercap	powercap: restrict energy meter to root access	2020-11-10 21:11:27 +01:00
pps
ps3
ptp
pwm	pwm: img: Fix null pointer access in probe	2020-10-30 10:38:21 +01:00
rapidio	rapidio: fix the missed put_device() for rio_mport_add_riodev	2020-10-30 10:38:21 +01:00
ras
regulator	regulator: defer probe when trying to get voltage from unresolved supply	2020-11-18 19:18:40 +01:00
remoteproc	remoteproc: qcom: q6v5: Update running state before requesting stop	2020-08-21 11:05:34 +02:00
reset
rpmsg	rpmsg: glink: Use complete_all for open states	2020-11-05 11:08:43 +01:00
rtc	rtc: rx8010: don't modify the global rtc ops	2020-11-05 11:08:54 +01:00
s390	s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl	2020-10-01 13:14:54 +02:00
sbus
scsi	scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()	2020-11-18 19:18:45 +01:00
sfi
sh
siox
slimbus	slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback	2020-10-29 09:55:12 +01:00
sn
soc	soc: qcom: rpmh-rsc: Set suppress_bind_attrs flag	2020-08-19 08:14:50 +02:00
soundwire
spi	spi: spi-s3c64xx: Check return values	2020-10-29 09:55:05 +01:00
spmi
ssb
staging	staging: octeon: Drop on uncorrectable alignment or FCS error	2020-11-05 11:08:55 +01:00
target	scsi: target: tcmu: Fix warning: 'page' may be used uninitialized	2020-10-29 09:55:14 +01:00
tc
tee
thermal	thermal: rcar_thermal: Handle probe error gracefully	2020-10-01 13:14:39 +02:00
thunderbolt	thunderbolt: Add the missed ida_simple_remove() in ring_request_msix()	2020-11-18 19:18:49 +01:00
tty	serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init	2020-11-10 12:36:00 +01:00
uio	uio: Fix use-after-free in uio_unregister_device()	2020-11-18 19:18:49 +01:00
usb	xhci: hisilicon: fix refercence leak in xhci_histb_probe	2020-11-18 19:18:49 +01:00
uwb
vfio	vfio: platform: fix reference leak in vfio_platform_open	2020-11-18 19:18:46 +01:00
vhost	vringh: fix __vringh_iov() when riov and wiov are different	2020-11-05 11:08:53 +01:00
video	video: fbdev: pvr2fb: initialize variables	2020-11-05 11:08:39 +01:00
virt	drivers/virt/fsl_hypervisor: Fix error handling path	2020-10-29 09:55:09 +01:00
virtio	virtio_ring: Avoid loop when vq is broken in virtqueue_poll	2020-08-26 10:31:01 +02:00
visorbus
vlynq
vme
w1	w1: mxc_w1: Fix timeout resolution problem leading to bus error	2020-11-05 11:08:47 +01:00
watchdog	drivers: watchdog: rdc321x_wdt: Fix race condition bugs	2020-11-05 11:08:44 +01:00
xen	xen/events: block rogue events for some time	2020-11-05 11:08:37 +01:00
zorro
Kconfig
Makefile