| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-40916: drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found |
| |
| When reading EDID fails and driver reports no modes available, the DRM |
| core adds an artificial 1024x786 mode to the connector. Unfortunately |
| some variants of the Exynos HDMI (like the one in Exynos4 SoCs) are not |
| able to drive such mode, so report a safe 640x480 mode instead of nothing |
| in case of the EDID reading failure. |
| |
| This fixes the following issue observed on Trats2 board since commit |
| 13d5b040363c ("drm/exynos: do not return negative values from .get_modes()"): |
| |
| [drm] Exynos DRM: using 11c00000.fimd device for DMA mapping operations |
| exynos-drm exynos-drm: bound 11c00000.fimd (ops fimd_component_ops) |
| exynos-drm exynos-drm: bound 12c10000.mixer (ops mixer_component_ops) |
| exynos-dsi 11c80000.dsi: [drm:samsung_dsim_host_attach] Attached s6e8aa0 device (lanes:4 bpp:24 mode-flags:0x10b) |
| exynos-drm exynos-drm: bound 11c80000.dsi (ops exynos_dsi_component_ops) |
| exynos-drm exynos-drm: bound 12d00000.hdmi (ops hdmi_component_ops) |
| [drm] Initialized exynos 1.1.0 20180330 for exynos-drm on minor 1 |
| exynos-hdmi 12d00000.hdmi: [drm:hdmiphy_enable.part.0] *ERROR* PLL could not reach steady state |
| panel-samsung-s6e8aa0 11c80000.dsi.0: ID: 0xa2, 0x20, 0x8c |
| exynos-mixer 12c10000.mixer: timeout waiting for VSYNC |
| ------------[ cut here ]------------ |
| WARNING: CPU: 1 PID: 11 at drivers/gpu/drm/drm_atomic_helper.c:1682 drm_atomic_helper_wait_for_vblanks.part.0+0x2b0/0x2b8 |
| [CRTC:70:crtc-1] vblank wait timed out |
| Modules linked in: |
| CPU: 1 PID: 11 Comm: kworker/u16:0 Not tainted 6.9.0-rc5-next-20240424 #14913 |
| Hardware name: Samsung Exynos (Flattened Device Tree) |
| Workqueue: events_unbound deferred_probe_work_func |
| Call trace: |
| unwind_backtrace from show_stack+0x10/0x14 |
| show_stack from dump_stack_lvl+0x68/0x88 |
| dump_stack_lvl from __warn+0x7c/0x1c4 |
| __warn from warn_slowpath_fmt+0x11c/0x1a8 |
| warn_slowpath_fmt from drm_atomic_helper_wait_for_vblanks.part.0+0x2b0/0x2b8 |
| drm_atomic_helper_wait_for_vblanks.part.0 from drm_atomic_helper_commit_tail_rpm+0x7c/0x8c |
| drm_atomic_helper_commit_tail_rpm from commit_tail+0x9c/0x184 |
| commit_tail from drm_atomic_helper_commit+0x168/0x190 |
| drm_atomic_helper_commit from drm_atomic_commit+0xb4/0xe0 |
| drm_atomic_commit from drm_client_modeset_commit_atomic+0x23c/0x27c |
| drm_client_modeset_commit_atomic from drm_client_modeset_commit_locked+0x60/0x1cc |
| drm_client_modeset_commit_locked from drm_client_modeset_commit+0x24/0x40 |
| drm_client_modeset_commit from __drm_fb_helper_restore_fbdev_mode_unlocked+0x9c/0xc4 |
| __drm_fb_helper_restore_fbdev_mode_unlocked from drm_fb_helper_set_par+0x2c/0x3c |
| drm_fb_helper_set_par from fbcon_init+0x3d8/0x550 |
| fbcon_init from visual_init+0xc0/0x108 |
| visual_init from do_bind_con_driver+0x1b8/0x3a4 |
| do_bind_con_driver from do_take_over_console+0x140/0x1ec |
| do_take_over_console from do_fbcon_takeover+0x70/0xd0 |
| do_fbcon_takeover from fbcon_fb_registered+0x19c/0x1ac |
| fbcon_fb_registered from register_framebuffer+0x190/0x21c |
| register_framebuffer from __drm_fb_helper_initial_config_and_unlock+0x350/0x574 |
| __drm_fb_helper_initial_config_and_unlock from exynos_drm_fbdev_client_hotplug+0x6c/0xb0 |
| exynos_drm_fbdev_client_hotplug from drm_client_register+0x58/0x94 |
| drm_client_register from exynos_drm_bind+0x160/0x190 |
| exynos_drm_bind from try_to_bring_up_aggregate_device+0x200/0x2d8 |
| try_to_bring_up_aggregate_device from __component_add+0xb0/0x170 |
| __component_add from mixer_probe+0x74/0xcc |
| mixer_probe from platform_probe+0x5c/0xb8 |
| platform_probe from really_probe+0xe0/0x3d8 |
| really_probe from __driver_probe_device+0x9c/0x1e4 |
| __driver_probe_device from driver_probe_device+0x30/0xc0 |
| driver_probe_device from __device_attach_driver+0xa8/0x120 |
| __device_attach_driver from bus_for_each_drv+0x80/0xcc |
| bus_for_each_drv from __device_attach+0xac/0x1fc |
| __device_attach from bus_probe_device+0x8c/0x90 |
| bus_probe_device from deferred_probe_work_func+0x98/0xe0 |
| deferred_probe_work_func from process_one_work+0x240/0x6d0 |
| process_one_work from worker_thread+0x1a0/0x3f4 |
| worker_thread from kthread+0x104/0x138 |
| kthread from ret_from_fork+0x14/0x28 |
| Exception stack(0xf0895fb0 to 0xf0895ff8) |
| ... |
| irq event stamp: 82357 |
| hardirqs last enabled at (82363): [<c01a96e8>] vprintk_emit+0x308/0x33c |
| hardirqs last disabled at (82368): [<c01a969c>] vprintk_emit+0x2bc/0x33c |
| softirqs last enabled at (81614): [<c0101644>] __do_softirq+0x320/0x500 |
| softirqs last disabled at (81609): [<c012dfe0>] __irq_exit_rcu+0x130/0x184 |
| ---[ end trace 0000000000000000 ]--- |
| exynos-drm exynos-drm: [drm] *ERROR* flip_done timed out |
| exynos-drm exynos-drm: [drm] *ERROR* [CRTC:70:crtc-1] commit wait timed out |
| exynos-drm exynos-drm: [drm] *ERROR* flip_done timed out |
| exynos-drm exynos-drm: [drm] *ERROR* [CONNECTOR:74:HDMI-A-1] commit wait timed out |
| exynos-drm exynos-drm: [drm] *ERROR* flip_done timed out |
| exynos-drm exynos-drm: [drm] *ERROR* [PLANE:56:plane-5] commit wait timed out |
| exynos-mixer 12c10000.mixer: timeout waiting for VSYNC |
| |
| The Linux kernel CVE team has assigned CVE-2024-40916 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.4.274 with commit 348aa3d47e8bc2fa4e5b8079554724343631b82a and fixed in 5.4.279 with commit e23f2eaf51ecb6ab4ceb770e747d50c1db2eb222 |
| Issue introduced in 5.10.215 with commit a8cb3b072403ce0748d368278bc7ab87d15e90a7 and fixed in 5.10.221 with commit 4dfffb50316c761c59386c9b002a10ac6d7bb6c9 |
| Issue introduced in 5.15.154 with commit 912c149a52c37a2f8199449360bf392ae4ef7f4c and fixed in 5.15.162 with commit 6d6bb258d886e124e5a5328e947b36fdcb3a6028 |
| Issue introduced in 6.1.84 with commit 8f914db6fe252c5e78a9b8b03adc1b0a33aec25d and fixed in 6.1.95 with commit c3ca24dfe9a2b3f4e8899af108829b0f4b4b15ec |
| Issue introduced in 6.6.24 with commit b71ae5fb2dd3c89c66efa613dccffc45c246c8b9 and fixed in 6.6.35 with commit 35bcf16b4a28c10923ff391d14f6ed0ae471ee5f |
| Issue introduced in 6.9 with commit 13d5b040363c7ec0ac29c2de9cf661a24a8aa531 and fixed in 6.9.6 with commit 510a6c0dfa6ec61d07a4b64698d8dc60045bd632 |
| Issue introduced in 6.9 with commit 13d5b040363c7ec0ac29c2de9cf661a24a8aa531 and fixed in 6.10 with commit 799d4b392417ed6889030a5b2335ccb6dcf030ab |
| Issue introduced in 6.7.12 with commit d930ab0399c350f9da9c64030daca368c78e2f51 |
| Issue introduced in 6.8.3 with commit 1cef1ef376c6421bb18e2185b5e10973bc272136 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-40916 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/gpu/drm/exynos/exynos_hdmi.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/e23f2eaf51ecb6ab4ceb770e747d50c1db2eb222 |
| https://git.kernel.org/stable/c/4dfffb50316c761c59386c9b002a10ac6d7bb6c9 |
| https://git.kernel.org/stable/c/6d6bb258d886e124e5a5328e947b36fdcb3a6028 |
| https://git.kernel.org/stable/c/c3ca24dfe9a2b3f4e8899af108829b0f4b4b15ec |
| https://git.kernel.org/stable/c/35bcf16b4a28c10923ff391d14f6ed0ae471ee5f |
| https://git.kernel.org/stable/c/510a6c0dfa6ec61d07a4b64698d8dc60045bd632 |
| https://git.kernel.org/stable/c/799d4b392417ed6889030a5b2335ccb6dcf030ab |
