[PATCH] drm/amd/display: fix the system memory page fault because of copy overflow

[Huang Rui]

On Fri, Jan 15, 2021 at 07:26:23PM +0800, Chen, Jiansong (Simon) wrote:
> [AMD Public Use]
> 
> Hi Rui,
> Seems the change has violated the kernel coding style😊, please help check.
> https://www.kernel.org/doc/html/latest/process/coding-style.html
> 
> Allocating memory
> ......
> The preferred form for passing a size of a struct is the following:
> 
> p = kmalloc(sizeof(*p), ...);
> The alternative form where struct name is spelled out hurts readability and introduces an opportunity for a bug when the pointer variable type is changed but the corresponding sizeof that is passed to a memory allocator is not.

Yes, I see. Thanks.

Ray

> 
> Regards,
> Jiansong
> -----Original Message-----
> From: amd-gfx <amd-gfx-bounces at lists.freedesktop.org> On Behalf Of Huang Rui
> Sent: Saturday, January 16, 2021 2:47 AM
> To: amd-gfx at lists.freedesktop.org
> Cc: Deucher, Alexander <Alexander.Deucher at amd.com>; Su, Jinzhou (Joe) <Jinzhou.Su at amd.com>; Huang, Ray <Ray.Huang at amd.com>; Lee Jones <lee.jones at linaro.org>; Zhu, Changfeng <Changfeng.Zhu at amd.com>
> Subject: [PATCH] drm/amd/display: fix the system memory page fault because of copy overflow
> 
> The buffer is allocated with the size of pointer and copy with the size of data structure. Then trigger the system memory page fault. Use the orignal data structure to get the object size.
> 
> Fixes: a8e30005b drm/amd/display/dc/core/dc_link: Move some local data from the stack to the heap
> 
> Signed-off-by: Huang Rui <ray.huang at amd.com>
> Cc: Lee Jones <lee.jones at linaro.org>
> ---
>  drivers/gpu/drm/amd/display/dc/core/dc_link.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
> index 69573d67056d..73178978ae74 100644
> --- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
> +++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
> @@ -1380,7 +1380,7 @@ static bool dc_link_construct(struct dc_link *link,
> 
>  DC_LOGGER_INIT(dc_ctx->logger);
> 
> -info = kzalloc(sizeof(info), GFP_KERNEL);
> +info = kzalloc(sizeof(struct integrated_info), GFP_KERNEL);
>  if (!info)
>  goto create_fail;
> 
> @@ -1545,7 +1545,7 @@ static bool dc_link_construct(struct dc_link *link,
>  }
> 
>  if (bios->integrated_info)
> -memcpy(info, bios->integrated_info, sizeof(*info));
> +memcpy(info, bios->integrated_info, sizeof(struct integrated_info));
> 
>  /* Look for channel mapping corresponding to connector and device tag */
>  for (i = 0; i < MAX_NUMBER_OF_EXT_DISPLAY_PATH; i++) {
> --
> 2.25.1
> 
> _______________________________________________
> amd-gfx mailing list
> amd-gfx at lists.freedesktop.org
> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.freedesktop.org%2Fmailman%2Flistinfo%2Famd-gfx&data=04%7C01%7CJiansong.Chen%40amd.com%7Caa1f0e0196584ac4145208d8b942ff50%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637463044695608478%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=OhlBMm03tg0JUctjpEtO88hL1Dnu5wxt7Keuojm61NQ%3D&reserved=0