From nobody Wed Jun 17 01:34:37 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D1872D2488 for ; Tue, 28 Apr 2026 17:21:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777396907; cv=none; b=cbVtlOl7SJPJ3m9mYfwn0avPa++A8DhXbzpg16Tq9lQ74qIecVzgPkTbtRm1S+74QrmCl+SMsCT497FkSQqD1zQHDRfDeoKRnk3kXEsUUWIISS2k63LD/WYGpZE+/zTXRW97eQmtMrmpdk/8+OxCr9WAC6Vg/q/Ufk1K6I8owSU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777396907; c=relaxed/simple; bh=5AJj5gyS32IvdocMHajacRucw/Mcc7Uzq6Gz+k1sSWk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=feZaG8xtF8ATnn2ewt9qRF61KwQYCjcCNT9xGn3sN1l7/psEWjVd4aE2BUd3/9vrpPWexQY+QLLsHjEnTBDKSgpFcBqbP/XwCrF+lQIXBHXWQ54kVJsqOjFjA8J/f7oWYyTgmL9eihuW1Kw9STci4ANAR1c3qdKeLMC6l+KySo0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=Hq8pIB9p; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=K1zOn8da; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="Hq8pIB9p"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="K1zOn8da" Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 63SFscOj4070835 for ; Tue, 28 Apr 2026 17:21:44 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=xn9wqdSEMs33syKczrigyc 4LqCkPv8AmhRyIXWRuaVg=; b=Hq8pIB9prRvOZD/7ftf72Zaz+7Dawl4GP7e2gv NHkgfA8DCa8v4YkHYW7qWGUWCT68vS6C+Upipl4hRf61kkfedLEvhwy21r8rK/Ih QaD9AY90txWWv4ME7yDaS5wE0KaTwqupwhTMW0VJ3Cc969LC0lZhQ3NR4R3i8pEI 3Mv2Uvasf07LJyK4c+WekyA6xndp9dLzofmbalnMJJ+j0R2RtBB0+OEWYbnXg5Yv Gtb1hBYh8/Oj3Qdf1RYj4oMNr9ydjJiROH8xj/1RNNDWJ3W8M8q8AdDodl4QeH3o JfFG7JFgtgT5hnlhoF/MnVVjylVeUs2ANzS+AwJdfxvBBzWQ== Received: from mail-vk1-f198.google.com (mail-vk1-f198.google.com [209.85.221.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4dtttjhqd0-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 28 Apr 2026 17:21:43 +0000 (GMT) Received: by mail-vk1-f198.google.com with SMTP id 71dfb90a1353d-56eeaefec9bso11708358e0c.2 for ; Tue, 28 Apr 2026 10:21:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1777396903; x=1778001703; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=xn9wqdSEMs33syKczrigyc4LqCkPv8AmhRyIXWRuaVg=; b=K1zOn8da652NabquIx073zcPEO43/WjG3SZj3KrjMwrMjXFYch7OlUQQM3o/AW/4vc nfXhh/GnFGPWR0NVw6en6mxXdbZ3Nzps8lJ6KpBEDsM6GTRr19z/HgEjE2bzFP9RUePI F6S3fhTk1RJBBLwOA+ycU1YumkgfHsI48E8ZWuziEvYmo4rCtz7jHyvzkWCv4624JcD6 nEJkA2gekK4d4e9zl4O3iwZR5a6gDo38fhAGIrRYkKlZgA4gTJB996iknH8FIs0B05gU 72X95iJ+nwb+tL52VS91fYxmtGHXOlik3T8vo0cUm9lL9nykQ49n2Rz50Z/1ztya1h+T yhVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777396903; x=1778001703; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=xn9wqdSEMs33syKczrigyc4LqCkPv8AmhRyIXWRuaVg=; b=ouSkvvVrQn18yqlhnwhHo5P03c2Wa5DIVle3iz71Xxf1TNcY/hi2veMdWkQds3yZ/4 YxS6ZpEHmv29cs1Zbbr/vNInwUb7300R8ny7Wopsw3gxVzTW6WSGVpRrgpoZDhW/ke7Q J9LsTXb1p/CVAk+A+uqgPjcj0Jw+so6zYsic/CrXPWIoCabW3tMEiVVoiIcLF/GDFBKI ARJ+CQW6d87JHTsZ+KW8xIj5m0UTaCe+cwxgNT9u0CRo0kGUDR6KaJywv3zRwuJsW+ux PlFqVYwkgAJBJVeFCCJ9EPiIWA3ZhaQWUUsFE2lnnPGMsoL/CmGaB6QK81z4mr22EYeg uSHQ== X-Forwarded-Encrypted: i=1; AFNElJ+wKq5vqAuWxCcB6mc1YE1d/kZjlGPDtPR6ykvLVLbaWbOSF3Ovv/OJqvNRjifb7zNead7sSe9F3tbi9XU=@vger.kernel.org X-Gm-Message-State: AOJu0YxR0Tnxygt0vJkB6WDSFcQL5ti0+PaFsX7nKtcxW53cneo/3Le0 Od7I53E3QgFvkOcuufoJg6KhtivMpSnVKrmoVqyX1/C5DV+zAYeQv4sRD8CafhPvMv5l7Wi96CZ Ww8UsjG1qDZQIKF1P8fTziJj6un/GKvDv6xzNcjdv7gwi2NFacAWANTjsdSTlEobdcsmy1O0/Bb 4= X-Gm-Gg: AeBDievIvMhMAxNw3IgdBLVCc7+cHrm13xes4Isq9wNbm8Ih7aqhpN9M3KXmqHxTtuH Vj8FHUIYKEHWBZ+7wQi07CQ2iXgw95SbYOy+SWcxKxL1b5+FjhnVjqWVzajA1AFDriFibwX5S7f Pm8Gea9YARqj1TaYUz7vxvZlalhn6CGR/M96FcqOBbbZzUsUjfbJAVcN7yBSuGnnVWdrXZdwVl3 CtVsxpMHJCdlmLI6KHW0VwrU7ycQWndu4G8Ub5UipU8ulvKeH7dUCMtfltgUaB1BAOx201zPTvv PFdlkHnWUHuukERjA5r5+VG/+oaMi/k9FYjv2It5KyPzUit1Ig6wt59eSuR4TTju4rIGu2fBiNL +Fb4H66/okcKf+mQ4dggqbrtuLd6HjZPOxxmsm0ThQ4oygTqoRFHnDdbFjzLxzZBmT+lf1DxEC9 y4q6DhY/togzH+wbH3ULoXKE8hpUo17v4jKFWw+mGiE9UD5Q== X-Received: by 2002:a05:6122:1d44:b0:56d:b4d1:3c3a with SMTP id 71dfb90a1353d-573a530f08fmr2515049e0c.0.1777396902878; Tue, 28 Apr 2026 10:21:42 -0700 (PDT) X-Received: by 2002:a05:6122:1d44:b0:56d:b4d1:3c3a with SMTP id 71dfb90a1353d-573a530f08fmr2515031e0c.0.1777396902255; Tue, 28 Apr 2026 10:21:42 -0700 (PDT) Received: from umbar.lan (2001-14ba-a073-af00-264b-feff-fe8b-be8a.rev.dnainternet.fi. [2001:14ba:a073:af00:264b:feff:fe8b:be8a]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-3923f52e8b1sm8950271fa.23.2026.04.28.10.21.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 Apr 2026 10:21:40 -0700 (PDT) From: Dmitry Baryshkov Date: Tue, 28 Apr 2026 20:21:38 +0300 Subject: [PATCH] drm/msm/dsi: don't dump registers past the mapped region Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260428-msm-fix-dsi-dump-v1-1-5d4cb5ccfac7@oss.qualcomm.com> X-B4-Tracking: v=1; b=H4sIAKHs8GkC/yXMQQqDMBCF4auEWXfARG3Fq5QuNDPaKSRKRosg3 r2pLj8e799BOQkrtGaHxF9RmWKGvRnw7y6OjELZ4Ap3LyrXYNCAg2xIKkhrmNFWnh62r31ZMuT bnDjvZ/L5uqxr/2G//DtwHD/vbr1PdAAAAA== X-Change-ID: 20260428-msm-fix-dsi-dump-14cd71b5c33e To: Rob Clark , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Sean Paul , Marijn Suijten , David Airlie , Simona Vetter Cc: linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, freedreno@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.15.1 X-Developer-Signature: v=1; a=openpgp-sha256; l=1589; i=dmitry.baryshkov@oss.qualcomm.com; h=from:subject:message-id; bh=5AJj5gyS32IvdocMHajacRucw/Mcc7Uzq6Gz+k1sSWk=; b=owEBbQGS/pANAwAKAYs8ij4CKSjVAcsmYgBp8OyjNONsypGXls+eo1YAT9pue1gJLCpD4mCfE FI++wCgWh2JATMEAAEKAB0WIQRMcISVXLJjVvC4lX+LPIo+Aiko1QUCafDsowAKCRCLPIo+Aiko 1e6gB/9xe+C09T2JJBbS2bxIoXqB4T9B80/eImmquoUDc4l6N6VFEDPI8dQ0VyJfvLaUAMTXemy gW47ojNdlwVAKV7XsDy35ci8kiT4y7Pccmvn+GW8tZD7ihPHjD8EkR6ySMZmIIbrZCUq8d9RWhN dNxyBEdq/3F7NV7MwYSyhxgxQ/v1kuMSwZ1vpFQJa6+yHI9el1WMeCCnHFn12Z/Qtz+FqoIwKbp 67E9Im9yLj8nWnFWpYU8bkxs0vBHQ/2/HSygXQG5QPln9xXJlLY73xf7RRn0eFFpwAR8l2fdkXQ 8AGNBcNIechCM3HTh0c+v/7YScKfdLrBUkggL2MjweH0yaiR X-Developer-Key: i=dmitry.baryshkov@oss.qualcomm.com; a=openpgp; fpr=8F88381DD5C873E4AE487DA5199BF1243632046A X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDI4MDE2NyBTYWx0ZWRfX+uvWo4b0NZo6 ZxDuiZ3cyd8I295eL5M/k3lw+iI0ZWnwVwhKbqCdHnfp3n9jz1JWvqHuyCmbElQ06bWqBR+ujy9 9dgM3Tmpn2BtJ3C006XiF4vNU2Q0G4bI8/YRxs/ze6Suy4cJrzP1YfSpclHrTgBn97ygPwdvcIi wW3bIk+r/sSNGgUCEQMEbY2DHh1DhTWaAgmyfz9tL0ec2thXOPmjtkesVdD0CZlwBMBethjslNa acdX3v4EkGgEO6Iu5zP92NtuGaVn5Qu/aRhgdrpe3RCLm407MXb2FhxPlIyVMRjfjSjWBNeQaAL SBLbNxsu9heW1bglkIfU5GxlA6sVnxtBJa8eIwFAEwk2FiSm22xGx/b6aW0tFFnthsFyZ/XAUbS mYv1T9Rbet2oO+SBzZ9xOerMvCcOMabZ8d6zZuqgZwIIgwEzY3OGYZjZryYVfOusnN1FpWM1OVw SCd42VFZ0UAvdO47liw== X-Authority-Analysis: v=2.4 cv=TZKmcxQh c=1 sm=1 tr=0 ts=69f0eca7 cx=c_pps a=1Os3MKEOqt8YzSjcPV0cFA==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=A5OVakUREuEA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=ZpdpYltYx_vBUK5n70dp:22 a=EUspDBNiAAAA:8 a=FcX7t0_lAfRerrM-ltEA:9 a=QEXdDO2ut3YA:10 a=hhpmQAJR8DioWGSBphRh:22 X-Proofpoint-GUID: 2tBXytv6c7PuaHYk7sqCOVPa0Fg4OWs2 X-Proofpoint-ORIG-GUID: 2tBXytv6c7PuaHYk7sqCOVPa0Fg4OWs2 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-28_05,2026-04-28_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 spamscore=0 adultscore=0 phishscore=0 clxscore=1015 suspectscore=0 bulkscore=0 malwarescore=0 impostorscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2604200000 definitions=main-2604280167 On DSI 6G platforms the IO address space is internally adjusted by io_offset. Later this adjusted address might be used for memory dumping. However the size that is used for memory dumping isn't adjusted to account for the io_offset, leading to the potential access to the unmapped region. Lower ctrl_size by the io_offset value to prevent access past the mapped area. msm_disp_snapshot_add_block+0x1d4/0x3c8 [msm] (P) msm_dsi_host_snapshot+0x4c/0x78 [msm] msm_dsi_snapshot+0x28/0x50 [msm] msm_disp_snapshot_capture_state+0x74/0x140 [msm] msm_disp_snapshot_state_sync+0x60/0x90 [msm] _msm_disp_snapshot_work+0x30/0x90 [msm] kthread_worker_fn+0xdc/0x460 kthread+0x120/0x140 Fixes: bac2c6a62ed9 ("drm/msm: get rid of msm_iomap_size") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio --- drivers/gpu/drm/msm/dsi/dsi_host.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/d= si_host.c index 565d425f88b8..982abaaac00d 100644 --- a/drivers/gpu/drm/msm/dsi/dsi_host.c +++ b/drivers/gpu/drm/msm/dsi/dsi_host.c @@ -2033,6 +2033,7 @@ int msm_dsi_host_init(struct msm_dsi *msm_dsi) =20 /* fixup base address by io offset */ msm_host->ctrl_base +=3D cfg->io_offset; + msm_host->ctrl_size -=3D cfg->io_offset; =20 ret =3D devm_regulator_bulk_get_const(&pdev->dev, cfg->num_regulators, cfg->regulator_data, --- base-commit: bee6ea30c48788e18348309f891ed8afbf7702ac change-id: 20260428-msm-fix-dsi-dump-14cd71b5c33e Best regards, -- =20 With best wishes Dmitry