| From b4d25abf9720b69a03465b09d0d62d1998ed6708 Mon Sep 17 00:00:00 2001 |
| From: Douglas Anderson <dianders@chromium.org> |
| Date: Wed, 3 Nov 2021 15:31:08 -0700 |
| Subject: drm/msm/a6xx: Allocate enough space for GMU registers |
| |
| From: Douglas Anderson <dianders@chromium.org> |
| |
| commit b4d25abf9720b69a03465b09d0d62d1998ed6708 upstream. |
| |
| In commit 142639a52a01 ("drm/msm/a6xx: fix crashstate capture for |
| A650") we changed a6xx_get_gmu_registers() to read 3 sets of |
| registers. Unfortunately, we didn't change the memory allocation for |
| the array. That leads to a KASAN warning (this was on the chromeos-5.4 |
| kernel, which has the problematic commit backported to it): |
| |
| BUG: KASAN: slab-out-of-bounds in _a6xx_get_gmu_registers+0x144/0x430 |
| Write of size 8 at addr ffffff80c89432b0 by task A618-worker/209 |
| CPU: 5 PID: 209 Comm: A618-worker Tainted: G W 5.4.156-lockdep #22 |
| Hardware name: Google Lazor Limozeen without Touchscreen (rev5 - rev8) (DT) |
| Call trace: |
| dump_backtrace+0x0/0x248 |
| show_stack+0x20/0x2c |
| dump_stack+0x128/0x1ec |
| print_address_description+0x88/0x4a0 |
| __kasan_report+0xfc/0x120 |
| kasan_report+0x10/0x18 |
| __asan_report_store8_noabort+0x1c/0x24 |
| _a6xx_get_gmu_registers+0x144/0x430 |
| a6xx_gpu_state_get+0x330/0x25d4 |
| msm_gpu_crashstate_capture+0xa0/0x84c |
| recover_worker+0x328/0x838 |
| kthread_worker_fn+0x32c/0x574 |
| kthread+0x2dc/0x39c |
| ret_from_fork+0x10/0x18 |
| |
| Allocated by task 209: |
| __kasan_kmalloc+0xfc/0x1c4 |
| kasan_kmalloc+0xc/0x14 |
| kmem_cache_alloc_trace+0x1f0/0x2a0 |
| a6xx_gpu_state_get+0x164/0x25d4 |
| msm_gpu_crashstate_capture+0xa0/0x84c |
| recover_worker+0x328/0x838 |
| kthread_worker_fn+0x32c/0x574 |
| kthread+0x2dc/0x39c |
| ret_from_fork+0x10/0x18 |
| |
| Fixes: 142639a52a01 ("drm/msm/a6xx: fix crashstate capture for A650") |
| Signed-off-by: Douglas Anderson <dianders@chromium.org> |
| Link: https://lore.kernel.org/r/20211103153049.1.Idfa574ccb529d17b69db3a1852e49b580132035c@changeid |
| Signed-off-by: Rob Clark <robdclark@chromium.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c |
| +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c |
| @@ -777,12 +777,12 @@ static void a6xx_get_gmu_registers(struc |
| struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu); |
| |
| a6xx_state->gmu_registers = state_kcalloc(a6xx_state, |
| - 2, sizeof(*a6xx_state->gmu_registers)); |
| + 3, sizeof(*a6xx_state->gmu_registers)); |
| |
| if (!a6xx_state->gmu_registers) |
| return; |
| |
| - a6xx_state->nr_gmu_registers = 2; |
| + a6xx_state->nr_gmu_registers = 3; |
| |
| /* Get the CX GMU registers from AHB */ |
| _a6xx_get_gmu_registers(gpu, a6xx_state, &a6xx_gmu_reglist[0], |