On 5/27/23 12:18, Sam Ravnborg wrote:
Hi Helge,
On Sat, May 27, 2023 at 11:19:02AM +0200, Helge Deller wrote:
syzbot repored this bug in the softcursor code:
BUG: KASAN: null-ptr-deref in soft_cursor+0x384/0x6b4
drivers/video/fbdev/core/softcursor.c:70
Read of size 16 at addr 0200
On 22/05/2023 14:25, Oded Gabbay wrote:
> We don't want to allow users to spam the kernel log and sending
> ioctls with bad opcodes is a sure way to do it.
>
> Signed-off-by: Oded Gabbay
> ---
> drivers/accel/habanalabs/common/habanalabs_ioctl.c | 6 +++---
> 1 file changed, 3 insertions(+), 3
use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url:
https://github.com/intel-lab-lkp/linux/commits/Min-Li/drm-radeon-fix-race-condition-UAF-in-radeon_gem_set_domain_ioctl/20230527-155623
base: git://anongit.freedesktop.org/drm/drm-mis
use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url:
https://github.com/intel-lab-lkp/linux/commits/Min-Li/drm-radeon-fix-race-condition-UAF-in-radeon_gem_set_domain_ioctl/20230527-155623
base: git://anongit.freedesktop.org/drm/drm-mis
Hi Helge,
On Sat, May 27, 2023 at 11:19:02AM +0200, Helge Deller wrote:
> syzbot repored this bug in the softcursor code:
>
> BUG: KASAN: null-ptr-deref in soft_cursor+0x384/0x6b4
> drivers/video/fbdev/core/softcursor.c:70
> Read of size 16 at addr 0200 by task kworker/u4:1/12
>
> C
Release ressources when init_imstt() returns failure.
Signed-off-by: Helge Deller
---
drivers/video/fbdev/imsttfb.c | 6 --
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
index 075f11991281..ee7d01ad1406 100644
---
Add missing cleanups in error path.
Signed-off-by: Helge Deller
---
drivers/video/fbdev/imsttfb.c | 6 +-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
index 975dd682fae4..075f11991281 100644
--- a/drivers/video/fbd
syzbot repored this bug in the softcursor code:
BUG: KASAN: null-ptr-deref in soft_cursor+0x384/0x6b4
drivers/video/fbdev/core/softcursor.c:70
Read of size 16 at addr 0200 by task kworker/u4:1/12
CPU: 0 PID: 12 Comm: kworker/u4:1 Not tainted 6.4.0-rc3-syzkaller-geb0f1697d729
#0
Hard
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any
issue:
Reported-and-tested-by: syzbot+d910bd780e6efac35...@syzkaller.appspotmail.com
Tested on:
commit: 9ee79acc fbcon: Prevent softcursor if no font set
git tree: https://github.com/hdeller/linux.