Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20210803181135.22298-1-novikov@ispras.ru> <CAHp75Vde1RAKTCTzmt0eHjNGrKUyi7r1rtNo934WW6wqi9T=ng@mail.gmail.com>
In-Reply-To: <CAHp75Vde1RAKTCTzmt0eHjNGrKUyi7r1rtNo934WW6wqi9T=ng@mail.gmail.com>
From:   Andy Shevchenko <andy.shevchenko@gmail.com>
Date:   Tue, 3 Aug 2021 21:30:17 +0300
Message-ID: <CAHp75VfVCk1ueQZiGnJqwhD=j+zpVZ3Q-GmLMKX9AfP_BFMPNA@mail.gmail.com>
Subject: Re: [PATCH] platform/x86: intel_pmc_core: Fix potential buffer overflows
To:     Evgeny Novikov <novikov@ispras.ru>
Cc:     Rajneesh Bhardwaj <irenic.rajneesh@gmail.com>,
        David E Box <david.e.box@intel.com>,
        Hans de Goede <hdegoede@redhat.com>,
        Mark Gross <mgross@linux.intel.com>,
        "David E. Box" <david.e.box@linux.intel.com>,
        Gayatri Kammela <gayatri.kammela@intel.com>,
        Platform Driver <platform-driver-x86@vger.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        ldv-project@linuxtesting.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Tue, Aug 3, 2021 at 9:26 PM Andy Shevchenko
<andy.shevchenko@gmail.com> wrote:
> On Tue, Aug 3, 2021 at 9:21 PM Evgeny Novikov <novikov@ispras.ru> wrote:
> >
> > It looks like pmc_core_get_low_power_modes() mixes up modes and
> > priorities. In addition to invalid behavior, potentially this can
> > cause buffer overflows since the driver reads priorities from the
> > register and then it uses them as indexes for array lpm_priority
> > that can contain 8 elements at most. The patch swaps modes and
> > priorities.
> >
> > Found by Linux Driver Verification project (linuxtesting.org).
>
> Seems legit.

Hold on, but then it follows with another loop where actually it reads
modes by priority index. Can you elaborate what exactly is the problem
you think?

-- 
With Best Regards,
Andy Shevchenko