From nobody Mon Sep 29 22:44:53 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8F71C00140 for ; Mon, 15 Aug 2022 22:22:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347536AbiHOWWc (ORCPT ); Mon, 15 Aug 2022 18:22:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56018 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350491AbiHOWRz (ORCPT ); Mon, 15 Aug 2022 18:17:55 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2BCAA4D262; Mon, 15 Aug 2022 12:41:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 95A5C611DD; Mon, 15 Aug 2022 19:40:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83E4FC433D6; Mon, 15 Aug 2022 19:40:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1660592458; bh=yqibmGB8lQdsS1eWP4a+ONsj3+OHTEMl5n8rAQ0Jouo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QvkyQPJIW8+UxDc4D3suHZ+nRU6NYBc0vocM4SBGkgvT5Z51PmwF4MzfuI9fPu255 7RzBczu8zCWuNWI9vj+fqxanL4XjEqOCG5sQz56ABqVLXwoCQTIXbA+xy/gl77yn6M CMwNDZMRlMghzSDy+h8vlPBe2ibnzWk/5TjUXt6o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Nuno=20Gon=C3=A7alves?= , Thomas Zimmermann , Javier Martinez Canillas , Maarten Lankhorst , Maxime Ripard Subject: [PATCH 5.19 0086/1157] drm/fb-helper: Fix out-of-bounds access Date: Mon, 15 Aug 2022 19:50:42 +0200 Message-Id: <20220815180442.996471118@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220815180439.416659447@linuxfoundation.org> References: <20220815180439.416659447@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Thomas Zimmermann commit ae25885bdf59fde40726863c57fd20e4a0642183 upstream. Clip memory range to screen-buffer size to avoid out-of-bounds access in fbdev deferred I/O's damage handling. Fbdev's deferred I/O can only track pages. From the range of pages, the damage handler computes the clipping rectangle for the display update. If the fbdev screen buffer ends near the beginning of a page, that page could contain more scanlines. The damage handler would then track these non-existing scanlines as dirty and provoke an out-of-bounds access during the screen update. Hence, clip the maximum memory range to the size of the screen buffer. While at it, rename the variables min/max to min_off/max_off in drm_fb_helper_deferred_io(). This avoids confusion with the macros of the same name. Reported-by: Nuno Gon=C3=A7alves Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Tested-by: Nuno Gon=C3=A7alves Fixes: 67b723f5b742 ("drm/fb-helper: Calculate damaged area in separate hel= per") Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: # v5.18+ Link: https://patchwork.freedesktop.org/patch/msgid/20220621104617.8817-1-t= zimmermann@suse.de Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/drm_fb_helper.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) --- a/drivers/gpu/drm/drm_fb_helper.c +++ b/drivers/gpu/drm/drm_fb_helper.c @@ -680,7 +680,11 @@ static void drm_fb_helper_damage(struct schedule_work(&helper->damage_work); } =20 -/* Convert memory region into area of scanlines and pixels per scanline */ +/* + * Convert memory region into area of scanlines and pixels per + * scanline. The parameters off and len must not reach beyond + * the end of the framebuffer. + */ static void drm_fb_helper_memory_range_to_clip(struct fb_info *info, off_t= off, size_t len, struct drm_rect *clip) { @@ -715,22 +719,29 @@ static void drm_fb_helper_memory_range_t */ void drm_fb_helper_deferred_io(struct fb_info *info, struct list_head *pag= ereflist) { - unsigned long start, end, min, max; + unsigned long start, end, min_off, max_off; struct fb_deferred_io_pageref *pageref; struct drm_rect damage_area; =20 - min =3D ULONG_MAX; - max =3D 0; + min_off =3D ULONG_MAX; + max_off =3D 0; list_for_each_entry(pageref, pagereflist, list) { start =3D pageref->offset; end =3D start + PAGE_SIZE; - min =3D min(min, start); - max =3D max(max, end); + min_off =3D min(min_off, start); + max_off =3D max(max_off, end); } - if (min >=3D max) + if (min_off >=3D max_off) return; =20 - drm_fb_helper_memory_range_to_clip(info, min, max - min, &damage_area); + /* + * As we can only track pages, we might reach beyond the end + * of the screen and account for non-existing scanlines. Hence, + * keep the covered memory area within the screen buffer. + */ + max_off =3D min(max_off, info->screen_size); + + drm_fb_helper_memory_range_to_clip(info, min_off, max_off - min_off, &dam= age_area); drm_fb_helper_damage(info, damage_area.x1, damage_area.y1, drm_rect_width(&damage_area), drm_rect_height(&damage_area));