github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-08-03 13:58:32 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
5bbf219328
linux/drivers
History
Kees Cook 5bbf219328 drm/radeon: Fix off-by-one power_state index heap overwrite 
An out of bounds write happens when setting the default power state.
KASAN sees this as:

[drm] radeon: 512M of GTT memory ready.
[drm] GART: num cpu pages 131072, num gpu pages 131072
==================================================================
BUG: KASAN: slab-out-of-bounds in
radeon_atombios_parse_power_table_1_3+0x1837/0x1998 [radeon]
Write of size 4 at addr ffff88810178d858 by task systemd-udevd/157

CPU: 0 PID: 157 Comm: systemd-udevd Not tainted 5.12.0-E620 #50
Hardware name: eMachines        eMachines E620  /Nile       , BIOS V1.03 09/30/2008
Call Trace:
 dump_stack+0xa5/0xe6
 print_address_description.constprop.0+0x18/0x239
 kasan_report+0x170/0x1a8
 radeon_atombios_parse_power_table_1_3+0x1837/0x1998 [radeon]
 radeon_atombios_get_power_modes+0x144/0x1888 [radeon]
 radeon_pm_init+0x1019/0x1904 [radeon]
 rs690_init+0x76e/0x84a [radeon]
 radeon_device_init+0x1c1a/0x21e5 [radeon]
 radeon_driver_load_kms+0xf5/0x30b [radeon]
 drm_dev_register+0x255/0x4a0 [drm]
 radeon_pci_probe+0x246/0x2f6 [radeon]
 pci_device_probe+0x1aa/0x294
 really_probe+0x30e/0x850
 driver_probe_device+0xe6/0x135
 device_driver_attach+0xc1/0xf8
 __driver_attach+0x13f/0x146
 bus_for_each_dev+0xfa/0x146
 bus_add_driver+0x2b3/0x447
 driver_register+0x242/0x2c1
 do_one_initcall+0x149/0x2fd
 do_init_module+0x1ae/0x573
 load_module+0x4dee/0x5cca
 __do_sys_finit_module+0xf1/0x140
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Without KASAN, this will manifest later when the kernel attempts to
allocate memory that was stomped, since it collides with the inline slab
freelist pointer:

invalid opcode: 0000 [#1] SMP NOPTI
CPU: 0 PID: 781 Comm: openrc-run.sh Tainted: G        W 5.10.12-gentoo-E620 #2
Hardware name: eMachines        eMachines E620  /Nile , BIOS V1.03       09/30/2008
RIP: 0010:kfree+0x115/0x230
Code: 89 c5 e8 75 ea ff ff 48 8b 00 0f ba e0 09 72 63 e8 1f f4 ff ff 41 89 c4 48 8b 45 00 0f ba e0 10 72 0a 48 8b 45 08 a8 01 75 02 <0f> 0b 44 89 e1 48 c7 c2 00 f0 ff ff be 06 00 00 00 48 d3 e2 48 c7
RSP: 0018:ffffb42f40267e10 EFLAGS: 00010246
RAX: ffffd61280ee8d88 RBX: 0000000000000004 RCX: 000000008010000d
RDX: 4000000000000000 RSI: ffffffffba1360b0 RDI: ffffd61280ee8d80
RBP: ffffd61280ee8d80 R08: ffffffffb91bebdf R09: 0000000000000000
R10: ffff8fe2c1047ac8 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000100
FS:  00007fe80eff6b68(0000) GS:ffff8fe339c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe80eec7bc0 CR3: 0000000038012000 CR4: 00000000000006f0
Call Trace:
 __free_fdtable+0x16/0x1f
 put_files_struct+0x81/0x9b
 do_exit+0x433/0x94d
 do_group_exit+0xa6/0xa6
 __x64_sys_exit_group+0xf/0xf
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fe80ef64bea
Code: Unable to access opcode bytes at RIP 0x7fe80ef64bc0.
RSP: 002b:00007ffdb1c47528 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fe80ef64bea
RDX: 00007fe80ef64f60 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 00007fe80ee2c620 R11: 0000000000000246 R12: 00007fe80eff41e0
R13: 00000000ffffffff R14: 0000000000000024 R15: 00007fe80edf9cd0
Modules linked in: radeon(+) ath5k(+) snd_hda_codec_realtek ...

Use a valid power_state index when initializing the "flags" and "misc"
and "misc2" fields.

Bug: https://bugzilla.kernel.org/show_bug.cgi?id=211537
Reported-by: Erhard F. <erhard_f@mailbox.org>
Fixes: a48b9b4edb ("drm/radeon/kms/pm: add asic specific callbacks for getting power state (v2)")
Fixes: 79daedc942 ("drm/radeon/kms: minor pm cleanups")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2021-05-04 17:37:49 -04:00
..
accessibility Char/Misc driver patches for 5.12-rc1 2021-02-24 10:25:37 -08:00
acpi ACPI: processor: Fix build when CONFIG_ACPI_PROCESSOR=m 2021-04-07 19:02:43 +02:00
amba amba: Make use of bus_type functions 2021-02-02 14:26:02 +01:00
android
ata ata: Avoid comma separated statements 2021-01-31 08:05:46 -07:00
atm module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
auxdisplay auxdisplay: Remove in_interrupt() usage. 2021-03-16 16:32:40 +01:00
base driver core: Fix locking bug in deferred_probe_timeout_work_func() 2021-04-05 09:14:18 +02:00
bcma
block block-5.12-2021-04-02 2021-04-02 16:13:13 -07:00
bluetooth Bluetooth: btusb: Revert Fix the autosuspend enable and disable 2021-04-09 09:08:02 -07:00
bus treewide: change my e-mail address, fix my name 2021-04-09 14:54:23 -07:00
cdrom
char parisc: parisc-agp requires SBA IOMMU driver 2021-04-06 11:46:39 +02:00
clk Merge tag 'drm-msm-next-2021-04-11' of https://gitlab.freedesktop.org/drm/msm into drm-next 2021-04-13 23:35:54 +02:00
clocksource A small set of clockevent fixes which fell through the cracks 2021-02-22 14:11:36 -08:00
connector
counter counter: stm32-timer-cnt: fix ceiling miss-alignment with reload register 2021-03-06 16:48:09 +00:00
cpufreq cpufreq: Fix scaling_{available,boost}_frequencies_show() comments 2021-03-26 17:43:48 +01:00
cpuidle
crypto vio: make remove callback return void 2021-03-02 22:41:23 +11:00
cxl cxl/mem: Fix potential memory leak 2021-02-22 14:44:39 -08:00
dax Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2021-02-27 08:07:12 -08:00
dca
devfreq Merge branches 'pm-devfreq' and 'pm-tools' 2021-02-15 17:02:04 +01:00
dio
dma dmaengine updates for v5.12-rc1 2021-02-23 15:05:10 -08:00
dma-buf drm/syncobj: use newly allocated stub fences 2021-04-08 12:21:13 +02:00
edac Merge branch 'edac-misc' into edac-updates-for-v5.12 2021-02-15 10:06:58 +01:00
eisa
extcon extcon: Fix error handling in extcon_dev_register 2021-03-15 11:09:38 +09:00
firewire firewire: nosy: Fix a use-after-free bug in nosy_ioctl() 2021-04-04 14:05:45 -07:00
firmware treewide: change my e-mail address, fix my name 2021-04-09 14:54:23 -07:00
fpga
fsi
gnss
gpio treewide: change my e-mail address, fix my name 2021-04-09 14:54:23 -07:00
gpu drm/radeon: Fix off-by-one power_state index heap overwrite 2021-05-04 17:37:49 -04:00
greybus greybus: es2: drop short control-transfer checks 2021-01-26 19:20:11 +01:00
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid 2021-02-23 14:52:22 -08:00
hsi
hv mm/memory_hotplug: MEMHP_MERGE_RESOURCE -> MHP_MERGE_RESOURCE 2021-02-26 09:41:00 -08:00
hwmon Devicetree updates for v5.12: 2021-02-22 10:05:12 -08:00
hwspinlock hwspinlock: omap: Add support for K3 AM64x SoCs 2021-02-09 11:36:50 -06:00
hwtracing ARM updates for 5.12-rc1: 2021-02-22 14:27:07 -08:00
i2c i2c: exynos5: correct top kerneldoc 2021-04-06 22:32:33 +02:00
i3c I3C for 5.12 2021-02-22 09:52:55 -08:00
ide ide-5.11-2021-02-28 2021-02-28 15:48:25 -08:00
idle
iio First set of IIO and counter fixes for the 5.12 cycle 2021-03-15 16:34:39 +01:00
infiniband RDMA/addr: Be strict with gid size 2021-04-08 16:14:56 -03:00
input module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
interconnect interconnect: Fix kerneldoc warning 2021-03-18 23:46:21 +02:00
iommu iommu/tegra-smmu: Make tegra_smmu_probe_device() to handle all IOMMU phandles 2021-03-18 11:31:12 +01:00
ipack ipack: Handle a driver without remove callback 2021-02-09 09:48:23 +01:00
irqchip irqchip/ingenic: Add support for the JZ4760 2021-03-09 08:45:17 +00:00
isdn isdn: capi: fix mismatched prototypes 2021-03-22 16:51:11 -07:00
leds treewide: change my e-mail address, fix my name 2021-04-09 14:54:23 -07:00
lightnvm lightnvm: pblk: Replace guid_copy() with export_guid()/import_guid() 2021-02-14 21:27:24 -07:00
macintosh
mailbox treewide: change my e-mail address, fix my name 2021-04-09 14:54:23 -07:00
mcb
md dm ioctl: fix out of bounds array access when no devices 2021-03-26 14:51:50 -04:00
media Merge drm/drm-fixes into drm-next 2021-04-13 23:15:09 +02:00
memory Char/Misc driver patches for 5.12-rc1 2021-02-24 10:25:37 -08:00
memstick
message scsi: message: fusion: Fix 'physical' typos 2021-01-26 23:25:16 -05:00
mfd mfd: intel_quark_i2c_gpio: Revert "Constify static struct resources" 2021-03-23 09:14:12 +00:00
misc mei: allow map and unmap of client dma buffer only for disconnected client 2021-03-23 15:15:15 +01:00
mmc mmc: cqhci: Fix random crash when remove mmc module/card 2021-03-09 10:00:52 +01:00
most most: core: Constify static attribute_group structs 2021-01-26 19:24:51 +01:00
mtd module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
mux
net net: hns3: Trivial spell fix in hns3 driver 2021-04-09 12:50:31 -07:00
nfc Char/Misc driver patches for 5.12-rc1 2021-02-24 10:25:37 -08:00
ntb NTB: Add support for EPF PCI Non-Transparent Bridge 2021-02-23 14:12:53 -06:00
nubus
nvdimm libnvdimm + device-dax for 5.12 2021-02-24 09:35:54 -08:00
nvme nvmet-tcp: fix kmap leak when data digest in use 2021-03-18 05:39:18 +01:00
nvmem nvmem: qcom-spmi-sdam: Fix uninitialized pdev pointer 2021-02-05 11:25:52 +01:00
of Devicetree fixes for v5.12, take 2: 2021-04-09 13:01:48 -07:00
opp opp: Don't drop extra references to OPPs accidentally 2021-03-12 09:26:52 +05:30
parisc
parport module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
pci powerpc fixes for 5.12 #4 2021-03-21 10:57:35 -07:00
pcmcia Merge branch 'pcmcia-next' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux 2021-02-26 13:54:43 -08:00
perf perf/arm_dmc620_pmu: Fix error return code in dmc620_pmu_device_probe() 2021-03-12 11:30:31 +00:00
phy phy: second round of phy fixes for v5.11 2021-02-10 10:39:23 +01:00
pinctrl intel-pinctrl for v5.12-3 2021-03-30 00:46:49 +02:00
platform platform/x86: intel-hid: Fix spurious wakeups caused by tablet-mode events during suspend 2021-04-06 22:10:21 +02:00
pnp
power power-supply: use kobj_to_dev() 2021-01-28 01:31:42 +01:00
powercap powercap/drivers/dtpm: Add the experimental label to the option description 2021-03-01 17:43:29 +01:00
pps
ps3
ptp ptp_qoriq: fix overflow in ptp_qoriq_adjfine() u64 calcalation 2021-03-24 12:10:03 -07:00
pwm pwm: Changes for v5.12-rc1 2021-02-25 12:23:49 -08:00
rapidio
ras RAS/CEC: Correct ce_add_elem()'s returned values 2021-04-07 11:52:26 +02:00
regulator regulator: bd9571mwv: Convert device attribute to sysfs_emit() 2021-03-15 15:42:12 +00:00
remoteproc remoteproc: pru: Fix firmware loading crashes on K3 SoCs 2021-03-17 14:15:07 -05:00
reset RISC-V Patches for the 5.12 Merge Window 2021-02-26 10:28:35 -08:00
rpmsg
rtc Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2021-02-27 08:07:12 -08:00
s390 module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi SCSI fixes on 20210410 2021-04-10 12:29:19 -07:00
sh module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
siox
slimbus
soc ARM SoC fixes for v5.12, part 2 2021-04-07 09:26:50 -07:00
soundwire ALSA: hda: move Intel SoundWire ACPI scan to dedicated module 2021-03-02 15:33:00 +01:00
spi spi: cadence: set cqspi to the driver_data field of struct device 2021-03-11 13:32:32 +00:00
spmi spmi: spmi-pmic-arb: Fix hw_irq overflow 2021-02-12 12:26:46 +01:00
ssb
staging staging: rtl8192e: Change state information from u16 to u8 2021-03-23 13:32:40 +01:00
target scsi: target: iscsi: Fix zero tag inside a trace event 2021-04-05 23:09:37 -04:00
tc
tee module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
thermal thermal/core: Add NULL pointer check before using cooling device stats 2021-03-17 09:55:58 +01:00
thunderbolt thunderbolt: Fix off by one in tb_port_find_retimer() 2021-03-30 13:38:10 +03:00
tty Serial driver fix for 5.12-rc6 2021-04-03 10:00:53 -07:00
uio uio: uio_pci_generic: don't fail probe if pdev->irq equals to IRQ_NOTCONNECTED 2021-02-09 12:25:32 +01:00
usb usbip: synchronize event handler with sysfs code paths 2021-04-05 09:05:42 +02:00
vdpa vdpa/mlx5: Fix suspend/resume index restoration 2021-04-09 12:08:28 -04:00
vfio vfio/nvlink: Add missing SPAPR_TCE_IOMMU depends 2021-03-29 14:48:00 -06:00
vhost virtio: fixes, cleanups 2021-03-18 11:20:35 -07:00
video Merge drm/drm-fixes into drm-next 2021-04-13 23:15:09 +02:00
virt virt: acrn: Correct type casting of argument of copy_from_user() 2021-03-10 16:59:50 +01:00
virtio virtio: fixes, cleanups 2021-03-18 11:20:35 -07:00
visorbus
vlynq
vme vme: make remove callback return void 2021-02-09 12:15:07 +01:00
w1 w1: w1_therm: Fix conversion result for negative temperatures 2021-01-27 14:59:16 +01:00
watchdog treewide: change my e-mail address, fix my name 2021-04-09 14:54:23 -07:00
xen xen: branch for v5.12-rc7 2021-04-09 09:58:42 -07:00
zorro
Kconfig cxl/mem: Introduce a driver for CXL-2.0-Type-3 endpoints 2021-02-16 20:36:38 -08:00
Makefile Simple Firmware Interface (SFI) support removal for v5.12-rc1 2021-02-24 10:35:29 -08:00