Messages in this thread | | | Date | Thu, 13 Apr 2023 21:20:23 +0200 | Subject | Re: [PATCH] drm/fbdev-generic: fix potential out-of-bounds access | From | Thomas Zimmermann <> |
| |
Hi
Am 13.04.23 um 20:56 schrieb Daniel Vetter: [...] > > This should switch the existing code over to using drm_framebuffer instead > of fbdev: > > > diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c > index ef4eb8b12766..99ca69dd432f 100644 > --- a/drivers/gpu/drm/drm_fb_helper.c > +++ b/drivers/gpu/drm/drm_fb_helper.c > @@ -647,22 +647,26 @@ static void drm_fb_helper_damage(struct drm_fb_helper *helper, u32 x, u32 y, > static void drm_fb_helper_memory_range_to_clip(struct fb_info *info, off_t off, size_t len, > struct drm_rect *clip) > { > + struct drm_fb_helper *helper = info->par; > + > off_t end = off + len; > u32 x1 = 0; > u32 y1 = off / info->fix.line_length; > - u32 x2 = info->var.xres; > - u32 y2 = DIV_ROUND_UP(end, info->fix.line_length); > + u32 x2 = helper->fb->height; > + unsigned stride = helper->fb->pitches[0]; > + u32 y2 = DIV_ROUND_UP(end, stride); > + int bpp = drm_format_info_bpp(helper->fb->format, 0);
Please DONT do that. The code here is fbdev code and shouldn't bother about DRM data structures. Actually, it shouldn't be here: a number of fbdev drivers with deferred I/O contain similar code and the fbdev module should provide us with a helper. (I think I even had some patches somewhere.)
Best regards Thomas
> > if ((y2 - y1) == 1) { > /* > * We've only written to a single scanline. Try to reduce > * the number of horizontal pixels that need an update. > */ > - off_t bit_off = (off % info->fix.line_length) * 8; > - off_t bit_end = (end % info->fix.line_length) * 8; > + off_t bit_off = (off % stride) * 8; > + off_t bit_end = (end % stride) * 8; > > - x1 = bit_off / info->var.bits_per_pixel; > - x2 = DIV_ROUND_UP(bit_end, info->var.bits_per_pixel); > + x1 = bit_off / bpp; > + x2 = DIV_ROUND_UP(bit_end, bpp); > } > > drm_rect_init(clip, x1, y1, x2 - x1, y2 - y1); > >> >>>>>>>> + screen_size = sizes->surface_height * buffer->fb->pitches[0]; >>>>>>>> + >>>>>>>> screen_buffer = vzalloc(screen_size); >>>>>>>> if (!screen_buffer) { >>>>>>>> ret = -ENOMEM; >>>>>>> Cheers, Daniel >>>>>>> >>>>>>>> -- >>>>>>>> 2.25.1 >>>>>>>> >>> >>> >
-- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Maxfeldstr. 5, 90409 Nürnberg, Germany (HRB 36809, AG Nürnberg) Geschäftsführer: Ivo Totev [unhandled content-type:application/pgp-signature] | |