Error in inner loop in validate_cmds_sorted / out of bounds issue

From: "Hanno Böck" <hanno@hboeck.de>
To: intel-gfx@lists.freedesktop.org
Subject: Error in inner loop in validate_cmds_sorted / out of bounds issue
Date: Sat, 25 Jul 2015 18:56:20 -0700	[thread overview]
Message-ID: <20150725185620.6c22c90a@pc1> (raw)

[-- Attachment #1.1: Type: text/plain, Size: 1006 bytes --]

Hi,

I was trying to track down an out of bounds read issue in the intel drm
driver that got reported by kasan.

It happens in the function validate_cmds_sorted (i915_cmd_parser.c),
where there are two nested loops, this is the relevant code part:
	for (i = 0; i < cmd_table_count; i++) {
		const struct drm_i915_cmd_table *table = &cmd_tables[i];
		u32 previous = 0;
		int j;

		for (j = 0; j < table->count; j++) {
			const struct drm_i915_cmd_descriptor *desc =
				&table->table[i];

Now that &table->table[i] should probably really be &table->table[j],
because that's the counter variable of the inner loop. Otherwise it
doesn't make any sense (the inner loop would just repeat doing the same
thing multiple times).
However if I try to change [i] to [j] here my system doesn't boot any
more, I just get a black screen. So I assume this bug is somehow hiding
another more severe bug.

cu,
-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno@hboeck.de
GPG: BBB51E42

[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx