linux-kernel - drm_modes: signed integer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <47527cdb-2eda-b5a3-d77c-3855b91a0b61@infradead.org>
Date:   Wed, 21 Oct 2020 20:13:43 -0700
From:   Randy Dunlap <rdunlap@...radead.org>
To:     dri-devel <dri-devel@...ts.freedesktop.org>,
        LKML <linux-kernel@...r.kernel.org>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        intel-gfx <intel-gfx@...ts.freedesktop.org>
Subject: drm_modes: signed integer overflow

Hi,

With linux-next 20201021, when booting up, I am seeing this:

[    0.560896] UBSAN: signed-integer-overflow in ../drivers/gpu/drm/drm_modes.c:765:20
[    0.560903] 2376000 * 1000 cannot be represented in type 'int'
[    0.560909] CPU: 3 PID: 7 Comm: kworker/u16:0 Not tainted 5.9.0-next-20201021 #2
[    0.560914] Hardware name: TOSHIBA PORTEGE R835/Portable PC, BIOS Version 4.10   01/08/2013
[    0.560924] Workqueue: events_unbound async_run_entry_fn

[    0.560930] Call Trace:
[    0.560938]  dump_stack+0x5e/0x74
[    0.560943]  ubsan_epilogue+0x9/0x45
[    0.560948]  handle_overflow+0x8b/0x98
[    0.560953]  ? set_track+0x3f/0xad
[    0.560958]  __ubsan_handle_mul_overflow+0xe/0x10
[    0.560964]  drm_mode_vrefresh+0x4a/0xbc
[    0.560970] initcall i915_init+0x0/0x6a returned 0 after 116076 usecs
[    0.560974] calling  cn_proc_init+0x0/0x36 @ 1
[    0.560978]  cea_mode_alternate_clock+0x11/0x62
[    0.560985]  drm_match_cea_mode+0xc7/0x1e7
[    0.560987] initcall cn_proc_init+0x0/0x36 returned 0 after 3 usecs
[    0.560990] calling  topology_sysfs_init+0x0/0x2d @ 1
[    0.561000]  drm_mode_validate_ycbcr420+0xd/0x48
[    0.561005]  drm_helper_probe_single_connector_modes+0x6db/0x7da
[    0.561012]  drm_client_modeset_probe+0x225/0x143f
[    0.561018]  ? bitmap_fold+0x8a/0x8a
[    0.561023]  ? update_cfs_rq_load_avg+0x192/0x1a2
[    0.561029]  __drm_fb_helper_initial_config_and_unlock+0x3f/0x5b7
[    0.561035]  ? get_sd_balance_interval+0x1c/0x40
[    0.561040]  drm_fb_helper_initial_config+0x48/0x4f
[    0.561047]  intel_fbdev_initial_config+0x13/0x23
[    0.561052]  async_run_entry_fn+0x89/0x15c
[    0.561058]  process_one_work+0x15c/0x1f3
[    0.561064]  worker_thread+0x1ac/0x25d
[    0.561069]  ? process_scheduled_works+0x2e/0x2e
[    0.561074]  kthread+0x10e/0x116
[    0.561078]  ? kthread_parkme+0x1c/0x1c
[    0.561083]  ret_from_fork+0x22/0x30
[    0.561087] ================================================================================

-- 
~Randy
Reported-by: Randy Dunlap <rdunlap@...radead.org>