From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ville =?iso-8859-1?Q?Syrj=E4l=E4?= Subject: Re: [PATCH] drm/atomic: fix out of bounds read in for_each_*_in_state helpers Date: Mon, 25 May 2015 16:57:41 +0300 Message-ID: <20150525135741.GH18908@intel.com> References: <1432549784-21966-1-git-send-email-a.ryabinin@samsung.com> <87oal8iyxh.fsf@intel.com> <556322E6.3020500@samsung.com> <87lhgcix4s.fsf@intel.com> <87iobgix28.fsf@intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by gabe.freedesktop.org (Postfix) with ESMTP id CDD586E47F for ; Mon, 25 May 2015 06:57:51 -0700 (PDT) Content-Disposition: inline In-Reply-To: <87iobgix28.fsf@intel.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Jani Nikula Cc: Andrey Ryabinin , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, Ander Conselvan de Oliveira List-Id: dri-devel@lists.freedesktop.org T24gTW9uLCBNYXkgMjUsIDIwMTUgYXQgMDQ6NTI6MzFQTSArMDMwMCwgSmFuaSBOaWt1bGEgd3Jv dGU6Cj4gT24gTW9uLCAyNSBNYXkgMjAxNSwgSmFuaSBOaWt1bGEgPGphbmkubmlrdWxhQGxpbnV4 LmludGVsLmNvbT4gd3JvdGU6Cj4gPiBPbiBNb24sIDI1IE1heSAyMDE1LCBBbmRyZXkgUnlhYmlu aW4gPGEucnlhYmluaW5Ac2Ftc3VuZy5jb20+IHdyb3RlOgo+ID4+IE9uIDA1LzI1LzIwMTUgMDQ6 MTIgUE0sIEphbmkgTmlrdWxhIHdyb3RlOgo+ID4+PiBPbiBNb24sIDI1IE1heSAyMDE1LCBBbmRy ZXkgUnlhYmluaW4gPGEucnlhYmluaW5Ac2Ftc3VuZy5jb20+IHdyb3RlOgo+ID4+Pj4gZm9yX2Vh Y2hfKl9pbl9zdGF0ZSB2YWxpZGF0ZSBhcnJheSBpbmRleCBhZnRlcgo+ID4+Pj4gYWNjZXNzIHRv IGFycmF5IGVsZW1lbnRzLCB0aHVzIHBlcmZvcm0gb3V0IG9mIGJvdW5kcyByZWFkLgo+ID4+Pj4K PiA+Pj4+IEZpeCB0aGlzIGJ5IHZhbGlkYXRpbmcgaW5kZXggaW4gdGhlIGZpcnN0IHBsYWNlIGFu ZCByZWFkCj4gPj4+PiBhcnJheSBlbGVtZW50IGlmZiB2YWxpZGF0aW9uIHdhcyBzdWNjZXNzZnVs Lgo+ID4+Pj4KPiA+Pj4+IEZpeGVzOiBkZjYzYjk5OTRlYWYgKCJkcm0vYXRvbWljOiBBZGQgZm9y X2VhY2hfe2Nvbm5lY3RvcixjcnRjLHBsYW5lfV9pbl9zdGF0ZSBoZWxwZXIgbWFjcm9zIikKPiA+ Pj4+IFNpZ25lZC1vZmYtYnk6IEFuZHJleSBSeWFiaW5pbiA8YS5yeWFiaW5pbkBzYW1zdW5nLmNv bT4KPiA+Pj4+IC0tLQo+ID4+Pj4gIGluY2x1ZGUvZHJtL2RybV9hdG9taWMuaCB8IDI0ICsrKysr KysrKysrKy0tLS0tLS0tLS0tLQo+ID4+Pj4gIDEgZmlsZSBjaGFuZ2VkLCAxMiBpbnNlcnRpb25z KCspLCAxMiBkZWxldGlvbnMoLSkKPiA+Pj4+Cj4gPj4+PiBkaWZmIC0tZ2l0IGEvaW5jbHVkZS9k cm0vZHJtX2F0b21pYy5oIGIvaW5jbHVkZS9kcm0vZHJtX2F0b21pYy5oCj4gPj4+PiBpbmRleCBj MTU3MTAzNC4uM2YxM2I5MSAxMDA2NDQKPiA+Pj4+IC0tLSBhL2luY2x1ZGUvZHJtL2RybV9hdG9t aWMuaAo+ID4+Pj4gKysrIGIvaW5jbHVkZS9kcm0vZHJtX2F0b21pYy5oCj4gPj4+PiBAQCAtNzcs MjYgKzc3LDI2IEBAIGludCBfX211c3RfY2hlY2sgZHJtX2F0b21pY19hc3luY19jb21taXQoc3Ry dWN0IGRybV9hdG9taWNfc3RhdGUgKnN0YXRlKTsKPiA+Pj4+ICAKPiA+Pj4+ICAjZGVmaW5lIGZv cl9lYWNoX2Nvbm5lY3Rvcl9pbl9zdGF0ZShzdGF0ZSwgY29ubmVjdG9yLCBjb25uZWN0b3Jfc3Rh dGUsIF9faSkgXAo+ID4+Pj4gIAlmb3IgKChfX2kpID0gMDsJCQkJCQkJXAo+ID4+Pj4gLQkgICAg IChjb25uZWN0b3IpID0gKHN0YXRlKS0+Y29ubmVjdG9yc1tfX2ldLAkJCVwKPiA+Pj4+IC0JICAg ICAoY29ubmVjdG9yX3N0YXRlKSA9IChzdGF0ZSktPmNvbm5lY3Rvcl9zdGF0ZXNbX19pXSwJXAo+ ID4+Pj4gLQkgICAgIChfX2kpIDwgKHN0YXRlKS0+bnVtX2Nvbm5lY3RvcjsJCQkJXAo+ID4+Pj4g KwkgICAgIChfX2kpIDwgKHN0YXRlKS0+bnVtX2Nvbm5lY3RvciAmJgkJCQlcCj4gPj4+PiArCSAg ICAgKChjb25uZWN0b3IpID0gKHN0YXRlKS0+Y29ubmVjdG9yc1tfX2ldLAkJCVwKPiA+Pj4+ICsJ ICAgICAoY29ubmVjdG9yX3N0YXRlKSA9IChzdGF0ZSktPmNvbm5lY3Rvcl9zdGF0ZXNbX19pXSwg MSk7IAlcCj4gPj4+IAo+ID4+PiBUaGlzIHdpbGwgc3RvcCBhdCB0aGUgZmlyc3QgTlVMTCBjb25u ZWN0b3IvY29ubmVjdG9yX3N0YXRlLiBTaW1pbGFybHkKPiA+Pj4gZm9yIHRoZSBsb29wcyBiZWxv dy4KPiA+Pj4gCj4gPj4KPiA+PiBUaGlzIHdpbGwgc3RvcCBpZmYgKF9faSkgPj0gKHN0YXRlKS0+ bnVtX2Nvbm5lY3RvciwgYmVjYXVzZSB0aGUgcmVzdWx0IG9mIGV4cHJlc3Npb246Cj4gPj4gCSAo KGNvbm5lY3RvcikgPSAoc3RhdGUpLT5jb25uZWN0b3JzW19faV0sIChjb25uZWN0b3Jfc3RhdGUp ID0gKHN0YXRlKS0+Y29ubmVjdG9yX3N0YXRlc1tfX2ldLCAxKQo+ID4+IGlzIGFsd2F5cyAxLgo+ ID4KPiA+IFdoeSBkbyB5b3UgdGhpbmsgaXQnbGwgYWx3YXlzIGJlIDE/Cj4gCj4gVGhhdCBtaWdo dCBiZSBiZWNhdXNlIHRoZXJlJ3MgdGhlIDEgYXQgdGhlIGVuZC4gKmJsdXNoKi4KPiAKPiBJIGRv IHdvbmRlciBpZiB0aGlzIGlzIHRvbyBzdWJ0bGUgaW4gZ2VuZXJhbCwgb3IgaWYgaXQncyBqdXN0 IHRvbyBzdWJ0bGUKPiBmb3IgbWUuCgpzLzEvdHJ1ZS8gbWlnaHQgbWFrZSBpdCBhIGJpdCBsZXNz IHN1YnRsZSwgYnV0IG5vdCBieSBtdWNoLgoKLS0gClZpbGxlIFN5cmrDpGzDpApJbnRlbCBPVEMK X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVs IG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHA6Ly9saXN0 cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9kcmktZGV2ZWwK From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751641AbbEYN5y (ORCPT ); Mon, 25 May 2015 09:57:54 -0400 Received: from mga01.intel.com ([192.55.52.88]:57786 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751213AbbEYN5x (ORCPT ); Mon, 25 May 2015 09:57:53 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.13,491,1427785200"; d="scan'208";a="715283000" Date: Mon, 25 May 2015 16:57:41 +0300 From: Ville =?iso-8859-1?Q?Syrj=E4l=E4?= To: Jani Nikula Cc: Andrey Ryabinin , David Airlie , Ander Conselvan de Oliveira , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Subject: Re: [PATCH] drm/atomic: fix out of bounds read in for_each_*_in_state helpers Message-ID: <20150525135741.GH18908@intel.com> References: <1432549784-21966-1-git-send-email-a.ryabinin@samsung.com> <87oal8iyxh.fsf@intel.com> <556322E6.3020500@samsung.com> <87lhgcix4s.fsf@intel.com> <87iobgix28.fsf@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <87iobgix28.fsf@intel.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, May 25, 2015 at 04:52:31PM +0300, Jani Nikula wrote: > On Mon, 25 May 2015, Jani Nikula wrote: > > On Mon, 25 May 2015, Andrey Ryabinin wrote: > >> On 05/25/2015 04:12 PM, Jani Nikula wrote: > >>> On Mon, 25 May 2015, Andrey Ryabinin wrote: > >>>> for_each_*_in_state validate array index after > >>>> access to array elements, thus perform out of bounds read. > >>>> > >>>> Fix this by validating index in the first place and read > >>>> array element iff validation was successful. > >>>> > >>>> Fixes: df63b9994eaf ("drm/atomic: Add for_each_{connector,crtc,plane}_in_state helper macros") > >>>> Signed-off-by: Andrey Ryabinin > >>>> --- > >>>> include/drm/drm_atomic.h | 24 ++++++++++++------------ > >>>> 1 file changed, 12 insertions(+), 12 deletions(-) > >>>> > >>>> diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h > >>>> index c1571034..3f13b91 100644 > >>>> --- a/include/drm/drm_atomic.h > >>>> +++ b/include/drm/drm_atomic.h > >>>> @@ -77,26 +77,26 @@ int __must_check drm_atomic_async_commit(struct drm_atomic_state *state); > >>>> > >>>> #define for_each_connector_in_state(state, connector, connector_state, __i) \ > >>>> for ((__i) = 0; \ > >>>> - (connector) = (state)->connectors[__i], \ > >>>> - (connector_state) = (state)->connector_states[__i], \ > >>>> - (__i) < (state)->num_connector; \ > >>>> + (__i) < (state)->num_connector && \ > >>>> + ((connector) = (state)->connectors[__i], \ > >>>> + (connector_state) = (state)->connector_states[__i], 1); \ > >>> > >>> This will stop at the first NULL connector/connector_state. Similarly > >>> for the loops below. > >>> > >> > >> This will stop iff (__i) >= (state)->num_connector, because the result of expression: > >> ((connector) = (state)->connectors[__i], (connector_state) = (state)->connector_states[__i], 1) > >> is always 1. > > > > Why do you think it'll always be 1? > > That might be because there's the 1 at the end. *blush*. > > I do wonder if this is too subtle in general, or if it's just too subtle > for me. s/1/true/ might make it a bit less subtle, but not by much. -- Ville Syrjälä Intel OTC