Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753680AbbEZP3t (ORCPT ); Tue, 26 May 2015 11:29:49 -0400 Received: from mail-wi0-f177.google.com ([209.85.212.177]:33523 "EHLO mail-wi0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751963AbbEZP3q (ORCPT ); Tue, 26 May 2015 11:29:46 -0400 Date: Tue, 26 May 2015 17:32:13 +0200 From: Daniel Vetter To: Andrey Ryabinin Cc: David Airlie , Ander Conselvan de Oliveira , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Subject: Re: [PATCH] drm/atomic: fix out of bounds read in for_each_*_in_state helpers Message-ID: <20150526153213.GR12971@phenom.ffwll.local> Mail-Followup-To: Andrey Ryabinin , David Airlie , Ander Conselvan de Oliveira , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org References: <1432549784-21966-1-git-send-email-a.ryabinin@samsung.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1432549784-21966-1-git-send-email-a.ryabinin@samsung.com> X-Operating-System: Linux phenom 4.0.0-rc3+ User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3004 Lines: 78 On Mon, May 25, 2015 at 01:29:44PM +0300, Andrey Ryabinin wrote: > for_each_*_in_state validate array index after > access to array elements, thus perform out of bounds read. > > Fix this by validating index in the first place and read > array element iff validation was successful. > > Fixes: df63b9994eaf ("drm/atomic: Add for_each_{connector,crtc,plane}_in_state helper macros") > Signed-off-by: Andrey Ryabinin Merged this for now to handle the regression, but yeah some polish might be good. -Daniel > --- > include/drm/drm_atomic.h | 24 ++++++++++++------------ > 1 file changed, 12 insertions(+), 12 deletions(-) > > diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h > index c1571034..3f13b91 100644 > --- a/include/drm/drm_atomic.h > +++ b/include/drm/drm_atomic.h > @@ -77,26 +77,26 @@ int __must_check drm_atomic_async_commit(struct drm_atomic_state *state); > > #define for_each_connector_in_state(state, connector, connector_state, __i) \ > for ((__i) = 0; \ > - (connector) = (state)->connectors[__i], \ > - (connector_state) = (state)->connector_states[__i], \ > - (__i) < (state)->num_connector; \ > + (__i) < (state)->num_connector && \ > + ((connector) = (state)->connectors[__i], \ > + (connector_state) = (state)->connector_states[__i], 1); \ > (__i)++) \ > if (connector) > > #define for_each_crtc_in_state(state, crtc, crtc_state, __i) \ > for ((__i) = 0; \ > - (crtc) = (state)->crtcs[__i], \ > - (crtc_state) = (state)->crtc_states[__i], \ > - (__i) < (state)->dev->mode_config.num_crtc; \ > + (__i) < (state)->dev->mode_config.num_crtc && \ > + ((crtc) = (state)->crtcs[__i], \ > + (crtc_state) = (state)->crtc_states[__i], 1); \ > (__i)++) \ > if (crtc_state) > > -#define for_each_plane_in_state(state, plane, plane_state, __i) \ > - for ((__i) = 0; \ > - (plane) = (state)->planes[__i], \ > - (plane_state) = (state)->plane_states[__i], \ > - (__i) < (state)->dev->mode_config.num_total_plane; \ > - (__i)++) \ > +#define for_each_plane_in_state(state, plane, plane_state, __i) \ > + for ((__i) = 0; \ > + (__i) < (state)->dev->mode_config.num_total_plane && \ > + ((plane) = (state)->planes[__i], \ > + (plane_state) = (state)->plane_states[__i], 1); \ > + (__i)++) \ > if (plane_state) > > #endif /* DRM_ATOMIC_H_ */ > -- > 2.4.1 > > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > http://lists.freedesktop.org/mailman/listinfo/dri-devel -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/