linux-kernel - TILCDC driver - Array to keep register values during PM suspend is too small

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <55930EEB.5050602@bumbleB.de>
Date:	Tue, 30 Jun 2015 23:49:31 +0200
From:	Michael Bode <michael@...bleB.de>
To:	linux-kernel@...r.kernel.org
Subject: TILCDC driver - Array to keep register values during PM suspend is
 too small

Hi,

i currently try to write a LIDD version of the TILCDC driver in 
driver/gpu/drm.

During my investigations I found the function "tilcdc_pm_suspend" in 
tilcdc_drv.c:

#ifdef CONFIG_PM_SLEEP
static int tilcdc_pm_suspend(struct device *dev)
{
  .....

     /* Save register state: */
     for (i = 0; i < ARRAY_SIZE(registers); i++)
         if (registers[i].save && (priv->rev >= registers[i].rev))
             priv->saved_register[n++] = tilcdc_read(ddev, 
registers[i].reg);

     priv->ctx_valid = true;

     return 0;
}

The member "saved_register" that is filled with register values here is 
an array defined in tilcdc_drv.h:

struct tilcdc_drm_private {
.....
     /* register contents saved across suspend/resume: */
     u32 saved_register[12];
     bool ctx_valid;
.....

As you can see the size of that array is 12 times u32, so it can keep 12 
register values.

But if you have a look at the register list to be saved, you will find:

#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_PM_SLEEP)
static const struct {
     const char *name;
     uint8_t  rev;
     uint8_t  save;
     uint32_t reg;
} registers[] =        {
#define REG(rev, save, reg) { #reg, rev, save, reg }
         /* exists in revision 1: */
         REG(1, false, LCDC_PID_REG),
         REG(1, true,  LCDC_CTRL_REG),
         REG(1, false, LCDC_STAT_REG),
         REG(1, true,  LCDC_RASTER_CTRL_REG),
         REG(1, true,  LCDC_RASTER_TIMING_0_REG),
         REG(1, true,  LCDC_RASTER_TIMING_1_REG),
         REG(1, true,  LCDC_RASTER_TIMING_2_REG),
         REG(1, true,  LCDC_DMA_CTRL_REG),
         REG(1, true,  LCDC_DMA_FB_BASE_ADDR_0_REG),
         REG(1, true,  LCDC_DMA_FB_CEILING_ADDR_0_REG),
         REG(1, true,  LCDC_DMA_FB_BASE_ADDR_1_REG),
         REG(1, true,  LCDC_DMA_FB_CEILING_ADDR_1_REG),
         /* new in revision 2: */
         REG(2, false, LCDC_RAW_STAT_REG),
         REG(2, false, LCDC_MASKED_STAT_REG),
         REG(2, false, LCDC_INT_ENABLE_SET_REG),
         REG(2, false, LCDC_INT_ENABLE_CLR_REG),
         REG(2, false, LCDC_END_OF_INT_IND_REG),
         REG(2, true,  LCDC_CLK_ENABLE_REG),
         REG(2, true,  LCDC_INT_ENABLE_SET_REG),
#undef REG
};
#endif

And if I count correctly in case you have an LCDC Revision 2, there will 
be 19 registers saved to the array.
So probably you will write over the end of that array.

I hope the form of my post fits the posting rules of this forum. If not, 
sorry. It is my very first post!

Br,
Michael




--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/