Skip to contentSkip to conversation

drm/vmwgfx: fix memory corruption with legacy/sou connectors

PATCH In review Rob Clark 3 participants 3 messages Jan 17, 2018

Subsystems (4)
Stable branch DRM drivers DRM misc DRM driver for VMware virtual GPU
lore
Share & tools
lore

Rob Clark

author
#0 lore raw

PATCH 1/1 drm/vmwgfx: fix memory corruption with legacy/sou connectors

From: Rob Clark <[email protected]>

It looks like in all cases 'struct vmw_connector_state' is used. But only in stdu connectors, was atomic_{duplicate,destroy}_state() properly subclassed. Leading to writes beyond the end of the allocated connector state block and all sorts of fun memory corruption related crashes.

Fixes d7721ca71126 "drm/vmwgfx: Connector atomic state"
Cc <[email protected]>
Signed-off-by Rob Clark <[email protected]>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c  | 4 ++--
 drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c +2 -2
index b8a09807c5de..3824595fece1 100644
@@ -266,8 +266,8 @@ static const struct drm_connector_funcs vmw_legacy_connector_funcs = {
 	.set_property = vmw_du_connector_set_property,
 	.destroy = vmw_ldu_connector_destroy,
 	.reset = vmw_du_connector_reset,
-	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
-	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+	.atomic_duplicate_state = vmw_du_connector_duplicate_state,
+	.atomic_destroy_state = vmw_du_connector_destroy_state,
 	.atomic_set_property = vmw_du_connector_atomic_set_property,
 	.atomic_get_property = vmw_du_connector_atomic_get_property,
 };
drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c +2 -2
index bc5f6026573d..63a4cd794b73 100644
@@ -420,8 +420,8 @@ static const struct drm_connector_funcs vmw_sou_connector_funcs = {
 	.set_property = vmw_du_connector_set_property,
 	.destroy = vmw_sou_connector_destroy,
 	.reset = vmw_du_connector_reset,
-	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
-	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+	.atomic_duplicate_state = vmw_du_connector_duplicate_state,
+	.atomic_destroy_state = vmw_du_connector_destroy_state,
 	.atomic_set_property = vmw_du_connector_atomic_set_property,
 	.atomic_get_property = vmw_du_connector_atomic_get_property,
 };
Signature · 1 line
2.14.3
Reviewed-by on v1 1/1
#1 lore raw
Quoted 10 lines · Rob Clark

From: Rob Clark <[email protected]>

It looks like in all cases 'struct vmw_connector_state' is used. But only in stdu connectors, was atomic_{duplicate,destroy}_state() properly subclassed. Leading to writes beyond the end of the allocated connector state block and all sorts of fun memory corruption related crashes.

Fixes d7721ca71126 "drm/vmwgfx: Connector atomic state"
Cc <[email protected]>
Signed-off-by Rob Clark <[email protected]>
Reviewed-by Thomas Hellstrom <[email protected]>

Thanks, Rob!

/Thomas

Quoted 35 lines
---
  drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c  | 4 ++--
  drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 ++--
  2 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c +2 -2
index b8a09807c5de..3824595fece1 100644
@@ -266,8 +266,8 @@ static const struct drm_connector_funcs vmw_legacy_connector_funcs = {
  	.set_property = vmw_du_connector_set_property,
  	.destroy = vmw_ldu_connector_destroy,
  	.reset = vmw_du_connector_reset,
-	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
-	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+	.atomic_duplicate_state = vmw_du_connector_duplicate_state,
+	.atomic_destroy_state = vmw_du_connector_destroy_state,
  	.atomic_set_property = vmw_du_connector_atomic_set_property,
  	.atomic_get_property = vmw_du_connector_atomic_get_property,
  };
drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c +2 -2
index bc5f6026573d..63a4cd794b73 100644
@@ -420,8 +420,8 @@ static const struct drm_connector_funcs vmw_sou_connector_funcs = {
  	.set_property = vmw_du_connector_set_property,
  	.destroy = vmw_sou_connector_destroy,
  	.reset = vmw_du_connector_reset,
-	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
-	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+	.atomic_duplicate_state = vmw_du_connector_duplicate_state,
+	.atomic_destroy_state = vmw_du_connector_destroy_state,
  	.atomic_set_property = vmw_du_connector_atomic_set_property,
  	.atomic_get_property = vmw_du_connector_atomic_get_property,
  };
Reviewed-by on v1 1/1
#2 lore raw
In reply to Rob Clark

Thanks Rob for finding this one.

Reviewed-by Deepak Rawat <[email protected]>
Quoted 76 lines

From: dri-devel [mailto:[email protected]] On Behalf Of Rob Clark
Sent: Wednesday, January 17, 2018 7:16 AM
To: [email protected]
Cc: Thomas Hellstrom <[email protected]>; Rob Clark <[email protected]>; David Airlie <[email protected]>; linux- [email protected]; [email protected]; linux-graphics-maintainer <[email protected]>
Subject: [PATCH] drm/vmwgfx: fix memory corruption with legacy/sou connectors

From: Rob Clark <[email protected]>

It looks like in all cases 'struct vmw_connector_state' is used. But only in stdu connectors, was atomic_{duplicate,destroy}_state() properly subclassed. Leading to writes beyond the end of the allocated connector state block and all sorts of fun memory corruption related crashes.

Fixes d7721ca71126 "drm/vmwgfx: Connector atomic state"
Cc <[email protected]>
Signed-off-by Rob Clark <[email protected]>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c  | 4 ++--
 drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c +2 -2
index b8a09807c5de..3824595fece1 100644
@@ -266,8 +266,8 @@ static const struct drm_connector_funcs
 vmw_legacy_connector_funcs = {
 	.set_property = vmw_du_connector_set_property,
 	.destroy = vmw_ldu_connector_destroy,
 	.reset = vmw_du_connector_reset,
-	.atomic_duplicate_state =
 drm_atomic_helper_connector_duplicate_state,
-	.atomic_destroy_state =
 drm_atomic_helper_connector_destroy_state,
+	.atomic_duplicate_state = vmw_du_connector_duplicate_state,
+	.atomic_destroy_state = vmw_du_connector_destroy_state,
drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c +0 -0
 	.atomic_set_property = vmw_du_connector_atomic_set_property,
 	.atomic_get_property = vmw_du_connector_atomic_get_property,
 };
drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c +2 -2
index bc5f6026573d..63a4cd794b73 100644
@@ -420,8 +420,8 @@ static const struct drm_connector_funcs
 vmw_sou_connector_funcs = {
 	.set_property = vmw_du_connector_set_property,
 	.destroy = vmw_sou_connector_destroy,
 	.reset = vmw_du_connector_reset,
-	.atomic_duplicate_state =
 drm_atomic_helper_connector_duplicate_state,
-	.atomic_destroy_state =
 drm_atomic_helper_connector_destroy_state,
+	.atomic_duplicate_state = vmw_du_connector_duplicate_state,
+	.atomic_destroy_state = vmw_du_connector_destroy_state,
drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c +0 -1
 	.atomic_set_property = vmw_du_connector_atomic_set_property,
 	.atomic_get_property = vmw_du_connector_atomic_get_property,
 };
--

2.14.3

_______________________________________________
dri-devel mailing list [email protected]
https://urldefense.proofpoint.com/v2/url?u=https-
3A__lists.freedesktop.org_mailman_listinfo_dri- 2Ddevel&d=DwIGaQ&c=uilaK90D4TOVoH58JNXRgQ&r=zOOG28inJK0762SxAf - cyZdStnd2NQpRu98lJP2iYGw&m=h6TncxsxWnJOk_7aZZClV8O_VZGw8rtrIk_ BKtLUKM0&s=bizsNwniM18rOqG6MjlSY5t9fPsmxFrMgN_UqnI0vP0&e=