Re: [PATCH v2] drm/log: Batch vmap/vunmap and flush for record drawing

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unconditional clearing of lines 0, 1, and 2 can write past the end of the framebuffer if `scanout->rows` is less than 3.
--

--- Patch [1]: [PATCH v2] drm/log: Batch vmap/vunmap and flush for record drawing ---
commit 59469456017da9a89a891c48422d122f14da3c7a
Author: Shixiong Ou <[email protected]>

drm/log: Batch vmap/vunmap and flush for record drawing

This commit refactors drm_log_clear_line and drm_log_draw_line to accept a
pre-mapped iosys_map by value, removing the per-line vmap/vunmap/flush
calls. The single vmap/vunmap pair and flush are moved to
drm_log_draw_new_line.

> diff --git a/drivers/gpu/drm/clients/drm_log.c b/drivers/gpu/drm/clients/drm_log.c
> index e3e02c84a4cfe..97eddae3973f3 100644
> --- a/drivers/gpu/drm/clients/drm_log.c
> +++ b/drivers/gpu/drm/clients/drm_log.c

[ ... ]

> @@ -134,21 +125,40 @@ static void drm_log_draw_line(struct drm_log_scanout *scanout, const char *s,
>  	scanout->line++;
>  	if (scanout->line >= scanout->rows)
>  		scanout->line = 0;
> -	drm_client_buffer_vunmap_local(scanout->buffer);
> -	drm_client_buffer_flush(scanout->buffer, &r);
>  }
>  
>  static void drm_log_draw_new_line(struct drm_log_scanout *scanout,
> -				  const char *s, unsigned int len, unsigned int prefix_len)
> +				  const char *s, unsigned int len,
> +				  unsigned int prefix_len)
>  {
> +	struct iosys_map map;
> +	struct drm_framebuffer *fb = scanout->buffer->fb;
> +	u32 height = scanout->scaled_font_h;
> +	u32 line = scanout->line;
> +	u32 y2;
> +	struct drm_rect dirty;
> +
> +	if (drm_client_buffer_vmap_local(scanout->buffer, &map))
> +		return;
> +
>  	if (scanout->line == 0) {
> -		drm_log_clear_line(scanout, 0);
> -		drm_log_clear_line(scanout, 1);
> -		drm_log_clear_line(scanout, 2);
> +		drm_log_clear_line(scanout, 0, map);
> +		drm_log_clear_line(scanout, 1, map);
> +		drm_log_clear_line(scanout, 2, map);

[Severity: High]
This is a pre-existing issue, but can unconditionally clearing lines 0, 1,
and 2 write past the end of the framebuffer if scanout->rows is less than 3?

If the display has a very small vertical resolution, or if the scale module
parameter is set to a large value, scanout->rows can be less than 3.

When scanout->line == 0, drm_log_draw_new_line unconditionally clears line 2.
This calls drm_log_clear_line, which does:

static void drm_log_clear_line(struct drm_log_scanout *scanout, u32 line,
                               struct iosys_map map)
{
        ...
        iosys_map_memset(&map, line * height * fb->pitches[0], 0, height * fb->pitches[0]);
}

If line * height exceeds the actual framebuffer height, does this result in
an out-of-bounds memory write that could corrupt adjacent kernel memory?

> +		y2 = min(3, scanout->rows) * height;
> +	} else if (scanout->line + 2 < scanout->rows) {
> -		drm_log_clear_line(scanout, scanout->line + 2);
> +		drm_log_clear_line(scanout, scanout->line + 2, map);
> +		y2 = (line + 3) * height;
> +	} else {
> +		y2 = (line + 1) * height;
> +	}
> +
> -	drm_log_draw_line(scanout, s, len, prefix_len);
> +	drm_log_draw_line(scanout, s, len, prefix_len, map);
> +
> +	drm_client_buffer_vunmap_local(scanout->buffer);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1