mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-19 10:14:23 +08:00
5279fc7724
bdw_load_gamma_lut is writing beyond the array to the maximum value. The intend of the function is to clamp values > 1 to 1, so write the intended color to the max register. This fixes the following KASAN warning: [ 197.020857] [IGT] kms_pipe_color: executing [ 197.063434] [IGT] kms_pipe_color: starting subtest ctm-0-25-pipe0 [ 197.078989] ================================================================== [ 197.079127] BUG: KASAN: slab-out-of-bounds in bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915] [ 197.079188] Read of size 2 at addr ffff8800d38db150 by task kms_pipe_color/1839 [ 197.079208] CPU: 2 PID: 1839 Comm: kms_pipe_color Tainted: G U 4.13.0-rc1-patser+ #5211 [ 197.079215] Hardware name: NUC5i7RYB, BIOS RYBDWi35.86A.0246.2015.0309.1355 03/09/2015 [ 197.079220] Call Trace: [ 197.079230] dump_stack+0x68/0x9e [ 197.079239] print_address_description+0x6f/0x250 [ 197.079251] kasan_report+0x216/0x370 [ 197.079374] ? bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915] [ 197.079451] ? gen8_write16+0x4e0/0x4e0 [i915] [ 197.079460] __asan_report_load2_noabort+0x14/0x20 [ 197.079535] bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915] [ 197.079612] broadwell_load_luts+0x1df/0x550 [i915] [ 197.079690] intel_color_load_luts+0x7b/0x80 [i915] [ 197.079764] intel_begin_crtc_commit+0x138/0x760 [i915] [ 197.079783] drm_atomic_helper_commit_planes_on_crtc+0x1a3/0x820 [drm_kms_helper] [ 197.079859] ? intel_pre_plane_update+0x571/0x580 [i915] [ 197.079937] intel_update_crtc+0x238/0x330 [i915] [ 197.080016] intel_update_crtcs+0x10f/0x210 [i915] [ 197.080092] intel_atomic_commit_tail+0x1552/0x3340 [i915] [ 197.080101] ? _raw_spin_unlock+0x3c/0x40 [ 197.080110] ? __queue_work+0xb40/0xbf0 [ 197.080188] ? skl_update_crtcs+0xc00/0xc00 [i915] [ 197.080195] ? trace_hardirqs_on+0xd/0x10 [ 197.080269] ? intel_atomic_commit_ready+0x128/0x13c [i915] [ 197.080329] ? __i915_sw_fence_complete+0x5b8/0x6d0 [i915] [ 197.080336] ? debug_object_activate+0x39e/0x580 [ 197.080397] ? i915_sw_fence_await+0x30/0x30 [i915] [ 197.080409] ? __might_sleep+0x15b/0x180 [ 197.080483] intel_atomic_commit+0x944/0xa70 [i915] [ 197.080490] ? refcount_dec_and_test+0x11/0x20 [ 197.080567] ? intel_atomic_commit_tail+0x3340/0x3340 [i915] [ 197.080597] ? drm_atomic_crtc_set_property+0x303/0x580 [drm] [ 197.080674] ? intel_atomic_commit_tail+0x3340/0x3340 [i915] [ 197.080704] drm_atomic_commit+0xd7/0xe0 [drm] [ 197.080722] drm_atomic_helper_crtc_set_property+0xec/0x130 [drm_kms_helper] [ 197.080749] drm_mode_crtc_set_obj_prop+0x7d/0xb0 [drm] [ 197.080775] drm_mode_obj_set_property_ioctl+0x50b/0x5d0 [drm] [ 197.080783] ? __might_fault+0x104/0x180 [ 197.080809] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm] [ 197.080838] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm] [ 197.080861] drm_ioctl_kernel+0x154/0x1a0 [drm] [ 197.080885] drm_ioctl+0x624/0x8f0 [drm] [ 197.080910] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm] [ 197.080934] ? drm_getunique+0x210/0x210 [drm] [ 197.080943] ? __handle_mm_fault+0x1bd0/0x1ce0 [ 197.080949] ? lock_downgrade+0x610/0x610 [ 197.080957] ? __lru_cache_add+0x15a/0x180 [ 197.080967] do_vfs_ioctl+0xd92/0xe40 [ 197.080975] ? ioctl_preallocate+0x1b0/0x1b0 [ 197.080982] ? selinux_capable+0x20/0x20 [ 197.080991] ? __do_page_fault+0x7b7/0x9a0 [ 197.080997] ? lock_downgrade+0x5bb/0x610 [ 197.081007] ? security_file_ioctl+0x57/0x90 [ 197.081016] SyS_ioctl+0x4e/0x80 [ 197.081024] entry_SYSCALL_64_fastpath+0x18/0xad [ 197.081030] RIP: 0033:0x7f61f287a987 [ 197.081035] RSP: 002b:00007fff7d44d188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 197.081043] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f61f287a987 [ 197.081048] RDX: 00007fff7d44d1c0 RSI: 00000000c01864ba RDI: 0000000000000003 [ 197.081053] RBP: 00007f61f2b3eb00 R08: 0000000000000059 R09: 0000000000000000 [ 197.081058] R10: 0000002ea5c4a290 R11: 0000000000000246 R12: 00007f61f2b3eb58 [ 197.081063] R13: 0000000000001010 R14: 00007f61f2b3eb58 R15: 0000000000002702 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101659 Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reported-by: Martin Peres <martin.peres@linux.intel.com> Cc: Martin Peres <martin.peres@linux.intel.com> Fixes: |
||
|---|---|---|
| .. | ||
| gvt | ||
| selftests | ||
| dvo_ch7xxx.c | ||
| dvo_ch7017.c | ||
| dvo_ivch.c | ||
| dvo_ns2501.c | ||
| dvo_sil164.c | ||
| dvo_tfp410.c | ||
| dvo.h | ||
| i915_cmd_parser.c | ||
| i915_debugfs.c | ||
| i915_drv.c | ||
| i915_drv.h | ||
| i915_gem_batch_pool.c | ||
| i915_gem_batch_pool.h | ||
| i915_gem_clflush.c | ||
| i915_gem_clflush.h | ||
| i915_gem_context.c | ||
| i915_gem_context.h | ||
| i915_gem_dmabuf.c | ||
| i915_gem_evict.c | ||
| i915_gem_execbuffer.c | ||
| i915_gem_fence_reg.c | ||
| i915_gem_fence_reg.h | ||
| i915_gem_gtt.c | ||
| i915_gem_gtt.h | ||
| i915_gem_internal.c | ||
| i915_gem_object.h | ||
| i915_gem_render_state.c | ||
| i915_gem_render_state.h | ||
| i915_gem_request.c | ||
| i915_gem_request.h | ||
| i915_gem_shrinker.c | ||
| i915_gem_stolen.c | ||
| i915_gem_tiling.c | ||
| i915_gem_timeline.c | ||
| i915_gem_timeline.h | ||
| i915_gem_userptr.c | ||
| i915_gem.c | ||
| i915_gem.h | ||
| i915_gpu_error.c | ||
| i915_guc_reg.h | ||
| i915_guc_submission.c | ||
| i915_ioc32.c | ||
| i915_irq.c | ||
| i915_memcpy.c | ||
| i915_mm.c | ||
| i915_oa_bdw.c | ||
| i915_oa_bdw.h | ||
| i915_oa_bxt.c | ||
| i915_oa_bxt.h | ||
| i915_oa_chv.c | ||
| i915_oa_chv.h | ||
| i915_oa_glk.c | ||
| i915_oa_glk.h | ||
| i915_oa_hsw.c | ||
| i915_oa_hsw.h | ||
| i915_oa_kblgt2.c | ||
| i915_oa_kblgt2.h | ||
| i915_oa_kblgt3.c | ||
| i915_oa_kblgt3.h | ||
| i915_oa_sklgt2.c | ||
| i915_oa_sklgt2.h | ||
| i915_oa_sklgt3.c | ||
| i915_oa_sklgt3.h | ||
| i915_oa_sklgt4.c | ||
| i915_oa_sklgt4.h | ||
| i915_params.c | ||
| i915_params.h | ||
| i915_pci.c | ||
| i915_perf.c | ||
| i915_pvinfo.h | ||
| i915_reg.h | ||
| i915_selftest.h | ||
| i915_suspend.c | ||
| i915_sw_fence.c | ||
| i915_sw_fence.h | ||
| i915_syncmap.c | ||
| i915_syncmap.h | ||
| i915_sysfs.c | ||
| i915_trace_points.c | ||
| i915_trace.h | ||
| i915_utils.h | ||
| i915_vgpu.c | ||
| i915_vgpu.h | ||
| i915_vma.c | ||
| i915_vma.h | ||
| intel_acpi.c | ||
| intel_atomic_plane.c | ||
| intel_atomic.c | ||
| intel_audio.c | ||
| intel_bios.c | ||
| intel_bios.h | ||
| intel_breadcrumbs.c | ||
| intel_cdclk.c | ||
| intel_color.c | ||
| intel_crt.c | ||
| intel_csr.c | ||
| intel_ddi.c | ||
| intel_device_info.c | ||
| intel_display.c | ||
| intel_dp_aux_backlight.c | ||
| intel_dp_link_training.c | ||
| intel_dp_mst.c | ||
| intel_dp.c | ||
| intel_dpio_phy.c | ||
| intel_dpll_mgr.c | ||
| intel_dpll_mgr.h | ||
| intel_drv.h | ||
| intel_dsi_dcs_backlight.c | ||
| intel_dsi_pll.c | ||
| intel_dsi_vbt.c | ||
| intel_dsi.c | ||
| intel_dsi.h | ||
| intel_dvo.c | ||
| intel_engine_cs.c | ||
| intel_fbc.c | ||
| intel_fbdev.c | ||
| intel_fifo_underrun.c | ||
| intel_frontbuffer.c | ||
| intel_frontbuffer.h | ||
| intel_guc_ct.c | ||
| intel_guc_ct.h | ||
| intel_guc_fwif.h | ||
| intel_guc_loader.c | ||
| intel_guc_log.c | ||
| intel_gvt.c | ||
| intel_gvt.h | ||
| intel_hangcheck.c | ||
| intel_hdmi.c | ||
| intel_hotplug.c | ||
| intel_huc.c | ||
| intel_i2c.c | ||
| intel_lpe_audio.c | ||
| intel_lrc.c | ||
| intel_lrc.h | ||
| intel_lspcon.c | ||
| intel_lvds.c | ||
| intel_mocs.c | ||
| intel_mocs.h | ||
| intel_modes.c | ||
| intel_opregion.c | ||
| intel_overlay.c | ||
| intel_panel.c | ||
| intel_pipe_crc.c | ||
| intel_pm.c | ||
| intel_psr.c | ||
| intel_renderstate_gen6.c | ||
| intel_renderstate_gen7.c | ||
| intel_renderstate_gen8.c | ||
| intel_renderstate_gen9.c | ||
| intel_renderstate.h | ||
| intel_ringbuffer.c | ||
| intel_ringbuffer.h | ||
| intel_runtime_pm.c | ||
| intel_sdvo_regs.h | ||
| intel_sdvo.c | ||
| intel_sideband.c | ||
| intel_sprite.c | ||
| intel_tv.c | ||
| intel_uc.c | ||
| intel_uc.h | ||
| intel_uncore.c | ||
| intel_uncore.h | ||
| intel_vbt_defs.h | ||
| Kconfig | ||
| Kconfig.debug | ||
| Makefile | ||