drm/msm/dsi: don't dump registers past the mapped region

[PATCH] drm/msm/dsi: don't dump registers past the mapped region

Posted by Dmitry Baryshkov 1 month, 2 weeks ago

On DSI 6G platforms the IO address space is internally adjusted by
io_offset. Later this adjusted address might be used for memory dumping.
However the size that is used for memory dumping isn't adjusted to
account for the io_offset, leading to the potential access to the
unmapped region. Lower ctrl_size by the io_offset value to prevent
access past the mapped area.

 msm_disp_snapshot_add_block+0x1d4/0x3c8 [msm] (P)
 msm_dsi_host_snapshot+0x4c/0x78 [msm]
 msm_dsi_snapshot+0x28/0x50 [msm]
 msm_disp_snapshot_capture_state+0x74/0x140 [msm]
 msm_disp_snapshot_state_sync+0x60/0x90 [msm]
 _msm_disp_snapshot_work+0x30/0x90 [msm]
 kthread_worker_fn+0xdc/0x460
 kthread+0x120/0x140

Fixes: bac2c6a62ed9 ("drm/msm: get rid of msm_iomap_size")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
 drivers/gpu/drm/msm/dsi/dsi_host.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index 565d425f88b8..982abaaac00d 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -2033,6 +2033,7 @@ int msm_dsi_host_init(struct msm_dsi *msm_dsi)
 
 	/* fixup base address by io offset */
 	msm_host->ctrl_base += cfg->io_offset;
+	msm_host->ctrl_size -= cfg->io_offset;
 
 	ret = devm_regulator_bulk_get_const(&pdev->dev, cfg->num_regulators,
 					    cfg->regulator_data,

---
base-commit: bee6ea30c48788e18348309f891ed8afbf7702ac
change-id: 20260428-msm-fix-dsi-dump-14cd71b5c33e

Best regards,
--  
With best wishes
Dmitry

Re: [PATCH] drm/msm/dsi: don't dump registers past the mapped region

Posted by Dmitry Baryshkov 1 month ago

On Tue, 28 Apr 2026 20:21:38 +0300, Dmitry Baryshkov wrote:
> On DSI 6G platforms the IO address space is internally adjusted by
> io_offset. Later this adjusted address might be used for memory dumping.
> However the size that is used for memory dumping isn't adjusted to
> account for the io_offset, leading to the potential access to the
> unmapped region. Lower ctrl_size by the io_offset value to prevent
> access past the mapped area.
> 
> [...]

Applied to msm-fixes, thanks!

[1/1] drm/msm/dsi: don't dump registers past the mapped region
      https://gitlab.freedesktop.org/lumag/msm/-/commit/5b49a46baa85

Best regards,
-- 
With best wishes
Dmitry

Re: [PATCH] drm/msm/dsi: don't dump registers past the mapped region

Posted by Konrad Dybcio 1 month, 2 weeks ago

On 4/28/26 7:21 PM, Dmitry Baryshkov wrote:
> On DSI 6G platforms the IO address space is internally adjusted by
> io_offset. Later this adjusted address might be used for memory dumping.
> However the size that is used for memory dumping isn't adjusted to
> account for the io_offset, leading to the potential access to the
> unmapped region. Lower ctrl_size by the io_offset value to prevent
> access past the mapped area.
> 
>  msm_disp_snapshot_add_block+0x1d4/0x3c8 [msm] (P)
>  msm_dsi_host_snapshot+0x4c/0x78 [msm]
>  msm_dsi_snapshot+0x28/0x50 [msm]
>  msm_disp_snapshot_capture_state+0x74/0x140 [msm]
>  msm_disp_snapshot_state_sync+0x60/0x90 [msm]
>  _msm_disp_snapshot_work+0x30/0x90 [msm]
>  kthread_worker_fn+0xdc/0x460
>  kthread+0x120/0x140
> 
> Fixes: bac2c6a62ed9 ("drm/msm: get rid of msm_iomap_size")
> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

Konrad