Tetsuo Handa
20e78b7d1c
fbcon: Use kzalloc() in fbcon_prepare_logo()
[ Upstream commit a6a00d7e8f ]
A kernel built with syzbot's config file reported that
scr_memcpyw(q, save, array3_size(logo_lines, new_cols, 2))
causes uninitialized "save" to be copied.
----------
[drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0
[drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1
Console: switching to colour frame buffer device 128x48
=====================================================
BUG: KMSAN: uninit-value in do_update_region+0x4b8/0xba0
do_update_region+0x4b8/0xba0
update_region+0x40d/0x840
fbcon_switch+0x3364/0x35e0
redraw_screen+0xae3/0x18a0
do_bind_con_driver+0x1cb3/0x1df0
do_take_over_console+0x11cb/0x13f0
fbcon_fb_registered+0xacc/0xfd0
register_framebuffer+0x1179/0x1320
__drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40
drm_fbdev_client_hotplug+0xbea/0xda0
drm_fbdev_generic_setup+0x65e/0x9d0
vkms_init+0x9f3/0xc76
(...snipped...)
Uninit was stored to memory at:
fbcon_prepare_logo+0x143b/0x1940
fbcon_init+0x2c1b/0x31c0
visual_init+0x3e7/0x820
do_bind_con_driver+0x14a4/0x1df0
do_take_over_console+0x11cb/0x13f0
fbcon_fb_registered+0xacc/0xfd0
register_framebuffer+0x1179/0x1320
__drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40
drm_fbdev_client_hotplug+0xbea/0xda0
drm_fbdev_generic_setup+0x65e/0x9d0
vkms_init+0x9f3/0xc76
(...snipped...)
Uninit was created at:
__kmem_cache_alloc_node+0xb69/0x1020
__kmalloc+0x379/0x680
fbcon_prepare_logo+0x704/0x1940
fbcon_init+0x2c1b/0x31c0
visual_init+0x3e7/0x820
do_bind_con_driver+0x14a4/0x1df0
do_take_over_console+0x11cb/0x13f0
fbcon_fb_registered+0xacc/0xfd0
register_framebuffer+0x1179/0x1320
__drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40
drm_fbdev_client_hotplug+0xbea/0xda0
drm_fbdev_generic_setup+0x65e/0x9d0
vkms_init+0x9f3/0xc76
(...snipped...)
CPU: 2 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc4-00356-g8f2975c2bb4c #924
Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
----------
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/cad03d25-0ea0-32c4-8173-fd1895314bce@I-love.SAKURA.ne.jp
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-14 11:28:26 +01:00
..
2020-10-29 09:55:09 +01:00
2022-12-14 11:28:26 +01:00
2021-09-22 11:48:04 +02:00
2022-04-15 14:14:55 +02:00
2022-04-15 14:14:55 +02:00
2021-09-22 11:48:04 +02:00
2022-08-25 11:15:24 +02:00
2022-08-25 11:15:24 +02:00
2022-08-25 11:15:27 +02:00
2021-09-22 11:48:04 +02:00
2022-04-15 14:14:41 +02:00
2020-12-30 11:25:54 +01:00
2022-09-15 12:17:05 +02:00
2022-04-15 14:14:55 +02:00
2019-02-12 19:47:15 +01:00
2020-08-26 10:31:05 +02:00
2021-05-26 11:48:35 +02:00
2021-01-12 20:10:20 +01:00
2022-08-25 11:15:47 +02:00
2021-05-26 11:48:34 +02:00
2021-03-04 09:39:38 +01:00
2020-08-19 08:14:51 +02:00
2022-09-05 10:26:34 +02:00
2020-11-05 11:08:39 +01:00
2022-09-28 11:02:53 +02:00
2020-02-24 08:34:36 +01:00
2020-08-19 08:14:54 +02:00
2022-08-25 11:15:27 +02:00
2019-11-24 08:20:36 +01:00
2019-05-25 18:23:36 +02:00
2022-04-15 14:14:56 +02:00
2022-11-03 23:52:28 +09:00
2019-10-07 18:56:30 +02:00
2022-10-26 13:19:21 +02:00
2022-04-15 14:14:55 +02:00
2020-10-29 09:55:09 +01:00
2022-08-25 11:15:26 +02:00
2022-04-15 14:14:55 +02:00