Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1466950 > unrolled thread
| Started by | Dmitry Osipenko <digetx@gmail.com> |
|---|---|
| First post | 2016-08-21 11:10 +0200 |
| Last post | 2016-08-24 16:20 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH] drm/tegra: Fix window[0] base address corruption Dmitry Osipenko <digetx@gmail.com> - 2016-08-21 11:10 +0200
Re: [PATCH] drm/tegra: Fix window[0] base address corruption Thierry Reding <thierry.reding@gmail.com> - 2016-08-24 16:20 +0200
| From | Dmitry Osipenko <digetx@gmail.com> |
|---|---|
| Date | 2016-08-21 11:10 +0200 |
| Subject | [PATCH] drm/tegra: Fix window[0] base address corruption |
| Message-ID | <s8wVr-6Pf-11@gated-at.bofh.it> |
Window uses shared stride for UV planes and tegra_dc_window struct defines array of 2 strides per window. That's not taken in account during setting up of the window addresses and strides, resulting in out-of-bounds write of the 3-rd (non-existent) V plane stride that overwrites Y plane base address. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> --- drivers/gpu/drm/tegra/dc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c index 39940f5..a98dd3e 100644 --- a/drivers/gpu/drm/tegra/dc.c +++ b/drivers/gpu/drm/tegra/dc.c @@ -590,7 +590,9 @@ static void tegra_plane_atomic_update(struct drm_plane *plane, struct tegra_bo *bo = tegra_fb_get_plane(fb, i); window.base[i] = bo->paddr + fb->offsets[i]; - window.stride[i] = fb->pitches[i]; + + if (i < 2) + window.stride[i] = fb->pitches[i]; } tegra_dc_setup_window(dc, p->index, &window); -- 2.9.3
[toc] | [next] | [standalone]
| From | Thierry Reding <thierry.reding@gmail.com> |
|---|---|
| Date | 2016-08-24 16:20 +0200 |
| Message-ID | <s9Hc5-3pN-1@gated-at.bofh.it> |
| In reply to | #1466950 |
[Multipart message — attachments visible in raw view] — view raw
On Sun, Aug 21, 2016 at 11:57:58AM +0300, Dmitry Osipenko wrote: > Window uses shared stride for UV planes and tegra_dc_window struct > defines array of 2 strides per window. That's not taken in account > during setting up of the window addresses and strides, resulting in > out-of-bounds write of the 3-rd (non-existent) V plane stride that > overwrites Y plane base address. > > Signed-off-by: Dmitry Osipenko <digetx@gmail.com> > --- > drivers/gpu/drm/tegra/dc.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) Applied and added a comment to the code why it is safe to do this. Thanks, Thierry
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web