iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers
History
Kees Cook 3596152510 drm/radeon: Fix off-by-one power_state index heap overwrite 
An out of bounds write happens when setting the default power state.
KASAN sees this as:

[drm] radeon: 512M of GTT memory ready.
[drm] GART: num cpu pages 131072, num gpu pages 131072
==================================================================
BUG: KASAN: slab-out-of-bounds in
radeon_atombios_parse_power_table_1_3+0x1837/0x1998 [radeon]
Write of size 4 at addr ffff88810178d858 by task systemd-udevd/157

CPU: 0 PID: 157 Comm: systemd-udevd Not tainted 5.12.0-E620 #50
Hardware name: eMachines        eMachines E620  /Nile       , BIOS V1.03 09/30/2008
Call Trace:
 dump_stack+0xa5/0xe6
 print_address_description.constprop.0+0x18/0x239
 kasan_report+0x170/0x1a8
 radeon_atombios_parse_power_table_1_3+0x1837/0x1998 [radeon]
 radeon_atombios_get_power_modes+0x144/0x1888 [radeon]
 radeon_pm_init+0x1019/0x1904 [radeon]
 rs690_init+0x76e/0x84a [radeon]
 radeon_device_init+0x1c1a/0x21e5 [radeon]
 radeon_driver_load_kms+0xf5/0x30b [radeon]
 drm_dev_register+0x255/0x4a0 [drm]
 radeon_pci_probe+0x246/0x2f6 [radeon]
 pci_device_probe+0x1aa/0x294
 really_probe+0x30e/0x850
 driver_probe_device+0xe6/0x135
 device_driver_attach+0xc1/0xf8
 __driver_attach+0x13f/0x146
 bus_for_each_dev+0xfa/0x146
 bus_add_driver+0x2b3/0x447
 driver_register+0x242/0x2c1
 do_one_initcall+0x149/0x2fd
 do_init_module+0x1ae/0x573
 load_module+0x4dee/0x5cca
 __do_sys_finit_module+0xf1/0x140
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Without KASAN, this will manifest later when the kernel attempts to
allocate memory that was stomped, since it collides with the inline slab
freelist pointer:

invalid opcode: 0000 [#1] SMP NOPTI
CPU: 0 PID: 781 Comm: openrc-run.sh Tainted: G        W 5.10.12-gentoo-E620 #2
Hardware name: eMachines        eMachines E620  /Nile , BIOS V1.03       09/30/2008
RIP: 0010:kfree+0x115/0x230
Code: 89 c5 e8 75 ea ff ff 48 8b 00 0f ba e0 09 72 63 e8 1f f4 ff ff 41 89 c4 48 8b 45 00 0f ba e0 10 72 0a 48 8b 45 08 a8 01 75 02 <0f> 0b 44 89 e1 48 c7 c2 00 f0 ff ff be 06 00 00 00 48 d3 e2 48 c7
RSP: 0018:ffffb42f40267e10 EFLAGS: 00010246
RAX: ffffd61280ee8d88 RBX: 0000000000000004 RCX: 000000008010000d
RDX: 4000000000000000 RSI: ffffffffba1360b0 RDI: ffffd61280ee8d80
RBP: ffffd61280ee8d80 R08: ffffffffb91bebdf R09: 0000000000000000
R10: ffff8fe2c1047ac8 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000100
FS:  00007fe80eff6b68(0000) GS:ffff8fe339c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe80eec7bc0 CR3: 0000000038012000 CR4: 00000000000006f0
Call Trace:
 __free_fdtable+0x16/0x1f
 put_files_struct+0x81/0x9b
 do_exit+0x433/0x94d
 do_group_exit+0xa6/0xa6
 __x64_sys_exit_group+0xf/0xf
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fe80ef64bea
Code: Unable to access opcode bytes at RIP 0x7fe80ef64bc0.
RSP: 002b:00007ffdb1c47528 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fe80ef64bea
RDX: 00007fe80ef64f60 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 00007fe80ee2c620 R11: 0000000000000246 R12: 00007fe80eff41e0
R13: 00000000ffffffff R14: 0000000000000024 R15: 00007fe80edf9cd0
Modules linked in: radeon(+) ath5k(+) snd_hda_codec_realtek ...

Use a valid power_state index when initializing the "flags" and "misc"
and "misc2" fields.

Bug: https://bugzilla.kernel.org/show_bug.cgi?id=211537
Reported-by: Erhard F. <erhard_f@mailbox.org>
Fixes: a48b9b4edb8b ("drm/radeon/kms/pm: add asic specific callbacks for getting power state (v2)")
Fixes: 79daedc94281 ("drm/radeon/kms: minor pm cleanups")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2021-05-10 18:06:45 -04:00
..
accessibility
Char/Misc driver patches for 5.12-rc1
2021-02-24 10:25:37 -08:00
acpi
ACPI: processor: Fix build when CONFIG_ACPI_PROCESSOR=m
2021-04-07 19:02:43 +02:00
amba
amba: Make use of bus_type functions
2021-02-02 14:26:02 +01:00
android
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
ata
ata: Avoid comma separated statements
2021-01-31 08:05:46 -07:00
atm
module: remove never implemented MODULE_SUPPORTED_DEVICE
2021-03-17 13:16:18 -07:00
auxdisplay
auxdisplay: Remove in_interrupt() usage.
2021-03-16 16:32:40 +01:00
base
driver core: Fix locking bug in deferred_probe_timeout_work_func()
2021-04-05 09:14:18 +02:00
bcma
…
block
block-5.12-2021-04-02
2021-04-02 16:13:13 -07:00
bluetooth
Bluetooth: btusb: Revert Fix the autosuspend enable and disable
2021-04-09 09:08:02 -07:00
bus
treewide: change my e-mail address, fix my name
2021-04-09 14:54:23 -07:00
cdrom
block: remove unnecessary argument from blk_execute_rq
2021-01-24 21:52:39 -07:00
char
parisc: parisc-agp requires SBA IOMMU driver
2021-04-06 11:46:39 +02:00
clk
Merge tag 'drm-msm-next-2021-04-11' of https://gitlab.freedesktop.org/drm/msm into drm-next
2021-04-13 23:35:54 +02:00
clocksource
A small set of clockevent fixes which fell through the cracks
2021-02-22 14:11:36 -08:00
connector
…
counter
counter: stm32-timer-cnt: fix ceiling miss-alignment with reload register
2021-03-06 16:48:09 +00:00
cpufreq
cpufreq: Fix scaling_{available,boost}_frequencies_show() comments
2021-03-26 17:43:48 +01:00
cpuidle
…
crypto
vio: make remove callback return void
2021-03-02 22:41:23 +11:00
cxl
cxl/mem: Fix potential memory leak
2021-02-22 14:44:39 -08:00
dax
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-02-27 08:07:12 -08:00
dca
…
devfreq
Merge branches 'pm-devfreq' and 'pm-tools'
2021-02-15 17:02:04 +01:00
dio
…
dma
dmaengine updates for v5.12-rc1
2021-02-23 15:05:10 -08:00
dma-buf
drm/syncobj: use newly allocated stub fences
2021-04-08 12:21:13 +02:00
edac
Merge branch 'edac-misc' into edac-updates-for-v5.12
2021-02-15 10:06:58 +01:00
eisa
…
extcon
extcon: Fix error handling in extcon_dev_register
2021-03-15 11:09:38 +09:00
firewire
firewire: nosy: Fix a use-after-free bug in nosy_ioctl()
2021-04-04 14:05:45 -07:00
firmware
treewide: change my e-mail address, fix my name
2021-04-09 14:54:23 -07:00
fpga
…
fsi
…
gnss
…
gpio
treewide: change my e-mail address, fix my name
2021-04-09 14:54:23 -07:00
gpu
drm/radeon: Fix off-by-one power_state index heap overwrite
2021-05-10 18:06:45 -04:00
greybus
greybus: es2: drop short control-transfer checks
2021-01-26 19:20:11 +01:00
hid
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
2021-02-23 14:52:22 -08:00
hsi
…
hv
mm/memory_hotplug: MEMHP_MERGE_RESOURCE -> MHP_MERGE_RESOURCE
2021-02-26 09:41:00 -08:00
hwmon
Devicetree updates for v5.12:
2021-02-22 10:05:12 -08:00
hwspinlock
hwspinlock: omap: Add support for K3 AM64x SoCs
2021-02-09 11:36:50 -06:00
hwtracing
ARM updates for 5.12-rc1:
2021-02-22 14:27:07 -08:00
i2c
i2c: exynos5: correct top kerneldoc
2021-04-06 22:32:33 +02:00
i3c
I3C for 5.12
2021-02-22 09:52:55 -08:00
ide
ide-5.11-2021-02-28
2021-02-28 15:48:25 -08:00
idle
intel_idle: remove definition of DEBUG
2021-01-22 16:46:16 +01:00
iio
First set of IIO and counter fixes for the 5.12 cycle
2021-03-15 16:34:39 +01:00
infiniband
RDMA/addr: Be strict with gid size
2021-04-08 16:14:56 -03:00
input
module: remove never implemented MODULE_SUPPORTED_DEVICE
2021-03-17 13:16:18 -07:00
interconnect
interconnect: Fix kerneldoc warning
2021-03-18 23:46:21 +02:00
iommu
iommu/tegra-smmu: Make tegra_smmu_probe_device() to handle all IOMMU phandles
2021-03-18 11:31:12 +01:00
ipack
ipack: Handle a driver without remove callback
2021-02-09 09:48:23 +01:00
irqchip
irqchip/ingenic: Add support for the JZ4760
2021-03-09 08:45:17 +00:00
isdn
isdn: capi: fix mismatched prototypes
2021-03-22 16:51:11 -07:00
leds
treewide: change my e-mail address, fix my name
2021-04-09 14:54:23 -07:00
lightnvm
lightnvm: pblk: Replace guid_copy() with export_guid()/import_guid()
2021-02-14 21:27:24 -07:00
macintosh
macintosh/adb-iop: Use big-endian autopoll mask
2021-01-25 13:23:38 +01:00
mailbox
treewide: change my e-mail address, fix my name
2021-04-09 14:54:23 -07:00
mcb
…
md
dm ioctl: fix out of bounds array access when no devices
2021-03-26 14:51:50 -04:00
media
Merge drm/drm-fixes into drm-next
2021-04-13 23:15:09 +02:00
memory
Char/Misc driver patches for 5.12-rc1
2021-02-24 10:25:37 -08:00
memstick
…
message
scsi: message: fusion: Fix 'physical' typos
2021-01-26 23:25:16 -05:00
mfd
mfd: intel_quark_i2c_gpio: Revert "Constify static struct resources"
2021-03-23 09:14:12 +00:00
misc
mei: allow map and unmap of client dma buffer only for disconnected client
2021-03-23 15:15:15 +01:00
mmc
mmc: cqhci: Fix random crash when remove mmc module/card
2021-03-09 10:00:52 +01:00
most
most: core: Constify static attribute_group structs
2021-01-26 19:24:51 +01:00
mtd
module: remove never implemented MODULE_SUPPORTED_DEVICE
2021-03-17 13:16:18 -07:00
mux
…
net
net: hns3: Trivial spell fix in hns3 driver
2021-04-09 12:50:31 -07:00
nfc
Char/Misc driver patches for 5.12-rc1
2021-02-24 10:25:37 -08:00
ntb
NTB: Add support for EPF PCI Non-Transparent Bridge
2021-02-23 14:12:53 -06:00
nubus
…
nvdimm
libnvdimm + device-dax for 5.12
2021-02-24 09:35:54 -08:00
nvme
nvmet-tcp: fix kmap leak when data digest in use
2021-03-18 05:39:18 +01:00
nvmem
nvmem: qcom-spmi-sdam: Fix uninitialized pdev pointer
2021-02-05 11:25:52 +01:00
of
Devicetree fixes for v5.12, take 2:
2021-04-09 13:01:48 -07:00
opp
opp: Don't drop extra references to OPPs accidentally
2021-03-12 09:26:52 +05:30
parisc
…
parport
module: remove never implemented MODULE_SUPPORTED_DEVICE
2021-03-17 13:16:18 -07:00
pci
powerpc fixes for 5.12 #4
2021-03-21 10:57:35 -07:00
pcmcia
Merge branch 'pcmcia-next' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux
2021-02-26 13:54:43 -08:00
perf
perf/arm_dmc620_pmu: Fix error return code in dmc620_pmu_device_probe()
2021-03-12 11:30:31 +00:00
phy
phy: second round of phy fixes for v5.11
2021-02-10 10:39:23 +01:00
pinctrl
intel-pinctrl for v5.12-3
2021-03-30 00:46:49 +02:00
platform
platform/x86: intel-hid: Fix spurious wakeups caused by tablet-mode events during suspend
2021-04-06 22:10:21 +02:00
pnp
PNP: pnpbios: Use DEFINE_SPINLOCK() for spinlock
2021-01-22 16:22:57 +01:00
power
power-supply: use kobj_to_dev()
2021-01-28 01:31:42 +01:00
powercap
powercap/drivers/dtpm: Add the experimental label to the option description
2021-03-01 17:43:29 +01:00
pps
…
ps3
…
ptp
ptp_qoriq: fix overflow in ptp_qoriq_adjfine() u64 calcalation
2021-03-24 12:10:03 -07:00
pwm
pwm: Changes for v5.12-rc1
2021-02-25 12:23:49 -08:00
rapidio
…
ras
RAS/CEC: Correct ce_add_elem()'s returned values
2021-04-07 11:52:26 +02:00
regulator
regulator: bd9571mwv: Convert device attribute to sysfs_emit()
2021-03-15 15:42:12 +00:00
remoteproc
remoteproc: pru: Fix firmware loading crashes on K3 SoCs
2021-03-17 14:15:07 -05:00
reset
RISC-V Patches for the 5.12 Merge Window
2021-02-26 10:28:35 -08:00
rpmsg
…
rtc
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-02-27 08:07:12 -08:00
s390
module: remove never implemented MODULE_SUPPORTED_DEVICE
2021-03-17 13:16:18 -07:00
sbus
module: remove never implemented MODULE_SUPPORTED_DEVICE
2021-03-17 13:16:18 -07:00
scsi
SCSI fixes on 20210410
2021-04-10 12:29:19 -07:00
sh
module: remove never implemented MODULE_SUPPORTED_DEVICE
2021-03-17 13:16:18 -07:00
siox
…
slimbus
…
soc
ARM SoC fixes for v5.12, part 2
2021-04-07 09:26:50 -07:00
soundwire
ALSA: hda: move Intel SoundWire ACPI scan to dedicated module
2021-03-02 15:33:00 +01:00
spi
spi: cadence: set cqspi to the driver_data field of struct device
2021-03-11 13:32:32 +00:00
spmi
spmi: spmi-pmic-arb: Fix hw_irq overflow
2021-02-12 12:26:46 +01:00
ssb
…
staging
staging: rtl8192e: Change state information from u16 to u8
2021-03-23 13:32:40 +01:00
target
scsi: target: iscsi: Fix zero tag inside a trace event
2021-04-05 23:09:37 -04:00
tc
…
tee
module: remove never implemented MODULE_SUPPORTED_DEVICE
2021-03-17 13:16:18 -07:00
thermal
thermal/core: Add NULL pointer check before using cooling device stats
2021-03-17 09:55:58 +01:00
thunderbolt
thunderbolt: Fix off by one in tb_port_find_retimer()
2021-03-30 13:38:10 +03:00
tty
Serial driver fix for 5.12-rc6
2021-04-03 10:00:53 -07:00
uio
uio: uio_pci_generic: don't fail probe if pdev->irq equals to IRQ_NOTCONNECTED
2021-02-09 12:25:32 +01:00
usb
usbip: synchronize event handler with sysfs code paths
2021-04-05 09:05:42 +02:00
vdpa
vdpa/mlx5: Fix suspend/resume index restoration
2021-04-09 12:08:28 -04:00
vfio
vfio/nvlink: Add missing SPAPR_TCE_IOMMU depends
2021-03-29 14:48:00 -06:00
vhost
virtio: fixes, cleanups
2021-03-18 11:20:35 -07:00
video
Merge drm/drm-fixes into drm-next
2021-04-13 23:15:09 +02:00
virt
virt: acrn: Correct type casting of argument of copy_from_user()
2021-03-10 16:59:50 +01:00
virtio
virtio: fixes, cleanups
2021-03-18 11:20:35 -07:00
visorbus
…
vlynq
…
vme
vme: make remove callback return void
2021-02-09 12:15:07 +01:00
w1
w1: w1_therm: Fix conversion result for negative temperatures
2021-01-27 14:59:16 +01:00
watchdog
treewide: change my e-mail address, fix my name
2021-04-09 14:54:23 -07:00
xen
xen: branch for v5.12-rc7
2021-04-09 09:58:42 -07:00
zorro
…
Kconfig
cxl/mem: Introduce a driver for CXL-2.0-Type-3 endpoints
2021-02-16 20:36:38 -08:00
Makefile
Simple Firmware Interface (SFI) support removal for v5.12-rc1
2021-02-24 10:35:29 -08:00