linux-kernel - Re: [PATCH] drm/format-helper: Fix dst computation in drm_fb_xrgb8888_to_rgb888

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 17 Nov 2021 15:56:27 +0100
From:   Thomas Zimmermann <tzimmermann@...e.de>
To:     Hector Martin <marcan@...can.st>,
        Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
        Maxime Ripard <mripard@...nel.org>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>
Cc:     stable@...r.kernel.org, linux-kernel@...r.kernel.org,
        dri-devel@...ts.freedesktop.org
Subject: Re: [PATCH] drm/format-helper: Fix dst computation in
 drm_fb_xrgb8888_to_rgb888_dstclip()

Hi

Am 17.11.21 um 15:22 schrieb Hector Martin:
> The dst pointer was being advanced by the clip width, not the full line
> stride, resulting in corruption. The clip offset was also calculated
> incorrectly.
> 
> Cc: stable@...r.kernel.org
> Signed-off-by: Hector Martin <marcan@...can.st>

Thanks for your patch, but you're probably on the wrong branch. We 
rewrote this code recently and fixed the issue in drm-misc-next. [1][2]

If anything, this patch could go into stable. If anyone wants to merge 
it there, then

Acked-by: Thomas Zimmermann <tzimmermann@...e.de>

Best regards
Thomas

[1] 
https://lore.kernel.org/dri-devel/20211110103702.374-5-tzimmermann@suse.de/
[2] 
https://cgit.freedesktop.org/drm/drm-misc/commit/?id=53bc2098d2b6ccff25fe13f9345cbb5c0ef34a99

> ---
>   drivers/gpu/drm/drm_format_helper.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_format_helper.c b/drivers/gpu/drm/drm_format_helper.c
> index e676921422b8..12bc6b45e95b 100644
> --- a/drivers/gpu/drm/drm_format_helper.c
> +++ b/drivers/gpu/drm/drm_format_helper.c
> @@ -366,12 +366,12 @@ void drm_fb_xrgb8888_to_rgb888_dstclip(void __iomem *dst, unsigned int dst_pitch
>   		return;
>   
>   	vaddr += clip_offset(clip, fb->pitches[0], sizeof(u32));
> -	dst += clip_offset(clip, dst_pitch, sizeof(u16));
> +	dst += clip_offset(clip, dst_pitch, 3);
>   	for (y = 0; y < lines; y++) {
>   		drm_fb_xrgb8888_to_rgb888_line(dbuf, vaddr, linepixels);
>   		memcpy_toio(dst, dbuf, dst_len);
>   		vaddr += fb->pitches[0];
> -		dst += dst_len;
> +		dst += dst_pitch;
>   	}
>   
>   	kfree(dbuf);
> 

-- 
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Ivo Totev

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (841 bytes)