linux-kernel - Re: A divide error bug in framebuffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YyA9Y+Cs8ZCYHXAT@intel.com>
Date:   Tue, 13 Sep 2022 11:20:51 +0300
From:   Ville Syrjälä <ville.syrjala@...ux.intel.com>
To:     butt3rflyh4ck <butterflyhuangxx@...il.com>
Cc:     maarten.lankhorst@...ux.intel.com, mripard@...nel.org,
        Thomas Zimmermann <tzimmermann@...e.de>,
        Dave Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        LKML <linux-kernel@...r.kernel.org>,
        dri-devel <dri-devel@...ts.freedesktop.org>,
        Ben Davis <ben.davis@....com>,
        Brian Starkey <brian.starkey@....com>,
        Liviu Dudau <Liviu.Dudau@....com>,
        Jonas Karlman <jonas@...boo.se>
Subject: Re: A divide error bug in framebuffer_check

On Tue, Sep 13, 2022 at 01:49:40AM +0800, butt3rflyh4ck wrote:
> Hi, there is a divide error bug in framebuffer_check in
> drivers/gpu/drm/drm_framebuffer.c in the latest kernel.
> we can trigger it via drm_mode_addfb2 IOCTL.
> The call trace is drm_mode_addfb2 -> drm_internal_framebuffer_create
> ->  framebuffer_check.
> let us see code below:
> ```
<snip>
> { .format = DRM_FORMAT_Q410, .depth = 0,
>   .num_planes = 3, .char_per_block = { 2, 2, 2 },
>   .block_w = { 1, 1, 1 }, .block_h = { 1, 1, 1 }, .hsub = 0,
>   .vsub = 0, .is_yuv = true },
> { .format = DRM_FORMAT_Q401, .depth = 0,
>   .num_planes = 3, .char_per_block = { 2, 2, 2 },
>   .block_w = { 1, 1, 1 }, .block_h = { 1, 1, 1 }, .hsub = 0,
>   .vsub = 0, .is_yuv = true },
> ```
> we can see format.hsub and format.vsub all are NULL.

Yeah, those look borked.

Added in commit 94b292b27734 ("drm: drm_fourcc: add NV15, Q410, Q401 YUV formats")

Adding the relevant people to cc...

-- 
Ville Syrjälä
Intel