linux-kernel - [PATCH 1/2] drm/nouveau: fix notifier memory corruption bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110419215048.GB2965@joi.lan>
Date:	Tue, 19 Apr 2011 23:50:48 +0200
From:	Marcin Slusarz <marcin.slusarz@...il.com>
To:	Ben Skeggs <bskeggs@...hat.com>
Cc:	Kyle Spaans <kspaans@...terloo.ca>, linux-kernel@...r.kernel.org,
	Dominik Brodowski <linux@...inikbrodowski.net>,
	airlied@...hat.com, dri-devel@...ts.freedesktop.org,
	mjg@...hat.com, maciej.rutecki@...il.com,
	nouveau@...ts.freedesktop.org,
	Nigel Cunningham <lkml@...elcunningham.com.au>,
	Nick Piggin <npiggin@...il.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Pekka Paalanen <pq@....fi>
Subject: [PATCH 1/2] drm/nouveau: fix notifier memory corruption bug

nouveau_bo_wr32 expects offset to be in words, but we pass value in bytes,
so after commit 73412c3854c877e5f37ad944ee8977addde4d35a ("drm/nouveau: allocate
kernel's notifier object at end of block") we started to overwrite some memory
after notifier buffer object (previously m2mf_ntfy was always 0, so it didn't
matter it was a value in bytes).

Reported-by: Dominik Brodowski <linux@...inikbrodowski.net>
Reported-by: Nigel Cunningham <lkml@...elcunningham.com.au>
Signed-off-by: Marcin Slusarz <marcin.slusarz@...il.com>
Cc: Ben Skeggs <bskeggs@...hat.com>
Cc: Pekka Paalanen <pq@....fi>
Cc: stable@...nel.org    [2.6.38]
---
 drivers/gpu/drm/nouveau/nouveau_fbcon.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 889c445..39aee6d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -181,13 +181,13 @@ nouveau_fbcon_sync(struct fb_info *info)
 		OUT_RING  (chan, 0);
 	}
 
-	nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy + 3, 0xffffffff);
+	nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3, 0xffffffff);
 	FIRE_RING(chan);
 	mutex_unlock(&chan->mutex);
 
 	ret = -EBUSY;
 	for (i = 0; i < 100000; i++) {
-		if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy + 3)) {
+		if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3)) {
 			ret = 0;
 			break;
 		}
-- 
1.7.4.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/