linux-kernel - Re: [PATCH] drm/exynos: fix accidental on-stack copy of exynos_drm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <699636b7-d737-4df4-92e9-43b0f52d4b99@samsung.com>
Date:   Thu, 14 Dec 2023 16:59:13 +0100
From:   Marek Szyprowski <m.szyprowski@...sung.com>
To:     Arnd Bergmann <arnd@...nel.org>, Inki Dae <inki.dae@...sung.com>,
        Seung-Woo Kim <sw0312.kim@...sung.com>,
        Kyungmin Park <kyungmin.park@...sung.com>,
        David Airlie <airlied@...il.com>,
        Daniel Vetter <daniel@...ll.ch>,
        Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>
Cc:     Arnd Bergmann <arnd@...db.de>,
        Alim Akhtar <alim.akhtar@...sung.com>,
        Thierry Reding <treding@...dia.com>,
        Steven Price <steven.price@....com>,
        Rob Herring <robh@...nel.org>, Robert Foss <rfoss@...nel.org>,
        Kieran Bingham <kieran.bingham+renesas@...asonboard.com>,
        Liviu Dudau <liviu.dudau@....com>,
        Sam Ravnborg <sam@...nborg.org>,
        dri-devel@...ts.freedesktop.org,
        linux-arm-kernel@...ts.infradead.org,
        linux-samsung-soc@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/exynos: fix accidental on-stack copy of
 exynos_drm_plane

On 14.12.2023 13:32, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@...db.de>
>
> gcc rightfully complains about excessive stack usage in the fimd_win_set_pixfmt()
> function:
>
> drivers/gpu/drm/exynos/exynos_drm_fimd.c: In function 'fimd_win_set_pixfmt':
> drivers/gpu/drm/exynos/exynos_drm_fimd.c:750:1: error: the frame size of 1032 bytes is larger than 1024 byte
> drivers/gpu/drm/exynos/exynos5433_drm_decon.c: In function 'decon_win_set_pixfmt':
> drivers/gpu/drm/exynos/exynos5433_drm_decon.c:381:1: error: the frame size of 1032 bytes is larger than 1024 bytes
>
> There is really no reason to copy the large exynos_drm_plane
> structure to the stack before using one of its members, so just
> use a pointer instead.
>
> Fixes: 6f8ee5c21722 ("drm/exynos: fimd: Make plane alpha configurable")
> Signed-off-by: Arnd Bergmann <arnd@...db.de>


Reviewed-by: Marek Szyprowski <m.szyprowski@...sung.com>


> ---
>   drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 4 ++--
>   drivers/gpu/drm/exynos/exynos_drm_fimd.c      | 4 ++--
>   2 files changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
> index 4d986077738b..bce027552474 100644
> --- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
> +++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
> @@ -319,9 +319,9 @@ static void decon_win_set_bldmod(struct decon_context *ctx, unsigned int win,
>   static void decon_win_set_pixfmt(struct decon_context *ctx, unsigned int win,
>   				 struct drm_framebuffer *fb)
>   {
> -	struct exynos_drm_plane plane = ctx->planes[win];
> +	struct exynos_drm_plane *plane = &ctx->planes[win];
>   	struct exynos_drm_plane_state *state =
> -		to_exynos_plane_state(plane.base.state);
> +		to_exynos_plane_state(plane->base.state);
>   	unsigned int alpha = state->base.alpha;
>   	unsigned int pixel_alpha;
>   	unsigned long val;
> diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
> index 8dde7b1e9b35..5bdc246f5fad 100644
> --- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
> +++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
> @@ -661,9 +661,9 @@ static void fimd_win_set_bldmod(struct fimd_context *ctx, unsigned int win,
>   static void fimd_win_set_pixfmt(struct fimd_context *ctx, unsigned int win,
>   				struct drm_framebuffer *fb, int width)
>   {
> -	struct exynos_drm_plane plane = ctx->planes[win];
> +	struct exynos_drm_plane *plane = &ctx->planes[win];
>   	struct exynos_drm_plane_state *state =
> -		to_exynos_plane_state(plane.base.state);
> +		to_exynos_plane_state(plane->base.state);
>   	uint32_t pixel_format = fb->format->format;
>   	unsigned int alpha = state->base.alpha;
>   	u32 val = WINCONx_ENWIN;

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland