From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jani Nikula Subject: Re: [PATCH] drm/atomic: fix out of bounds read in for_each_*_in_state helpers Date: Mon, 25 May 2015 16:52:31 +0300 Message-ID: <87iobgix28.fsf@intel.com> References: <1432549784-21966-1-git-send-email-a.ryabinin@samsung.com> <87oal8iyxh.fsf@intel.com> <556322E6.3020500@samsung.com> <87lhgcix4s.fsf@intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by gabe.freedesktop.org (Postfix) with ESMTP id 550FD6E46E for ; Mon, 25 May 2015 06:50:20 -0700 (PDT) In-Reply-To: <87lhgcix4s.fsf@intel.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Andrey Ryabinin , David Airlie Cc: Ander Conselvan de Oliveira , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org T24gTW9uLCAyNSBNYXkgMjAxNSwgSmFuaSBOaWt1bGEgPGphbmkubmlrdWxhQGxpbnV4LmludGVs LmNvbT4gd3JvdGU6Cj4gT24gTW9uLCAyNSBNYXkgMjAxNSwgQW5kcmV5IFJ5YWJpbmluIDxhLnJ5 YWJpbmluQHNhbXN1bmcuY29tPiB3cm90ZToKPj4gT24gMDUvMjUvMjAxNSAwNDoxMiBQTSwgSmFu aSBOaWt1bGEgd3JvdGU6Cj4+PiBPbiBNb24sIDI1IE1heSAyMDE1LCBBbmRyZXkgUnlhYmluaW4g PGEucnlhYmluaW5Ac2Ftc3VuZy5jb20+IHdyb3RlOgo+Pj4+IGZvcl9lYWNoXypfaW5fc3RhdGUg dmFsaWRhdGUgYXJyYXkgaW5kZXggYWZ0ZXIKPj4+PiBhY2Nlc3MgdG8gYXJyYXkgZWxlbWVudHMs IHRodXMgcGVyZm9ybSBvdXQgb2YgYm91bmRzIHJlYWQuCj4+Pj4KPj4+PiBGaXggdGhpcyBieSB2 YWxpZGF0aW5nIGluZGV4IGluIHRoZSBmaXJzdCBwbGFjZSBhbmQgcmVhZAo+Pj4+IGFycmF5IGVs ZW1lbnQgaWZmIHZhbGlkYXRpb24gd2FzIHN1Y2Nlc3NmdWwuCj4+Pj4KPj4+PiBGaXhlczogZGY2 M2I5OTk0ZWFmICgiZHJtL2F0b21pYzogQWRkIGZvcl9lYWNoX3tjb25uZWN0b3IsY3J0YyxwbGFu ZX1faW5fc3RhdGUgaGVscGVyIG1hY3JvcyIpCj4+Pj4gU2lnbmVkLW9mZi1ieTogQW5kcmV5IFJ5 YWJpbmluIDxhLnJ5YWJpbmluQHNhbXN1bmcuY29tPgo+Pj4+IC0tLQo+Pj4+ICBpbmNsdWRlL2Ry bS9kcm1fYXRvbWljLmggfCAyNCArKysrKysrKysrKystLS0tLS0tLS0tLS0KPj4+PiAgMSBmaWxl IGNoYW5nZWQsIDEyIGluc2VydGlvbnMoKyksIDEyIGRlbGV0aW9ucygtKQo+Pj4+Cj4+Pj4gZGlm ZiAtLWdpdCBhL2luY2x1ZGUvZHJtL2RybV9hdG9taWMuaCBiL2luY2x1ZGUvZHJtL2RybV9hdG9t aWMuaAo+Pj4+IGluZGV4IGMxNTcxMDM0Li4zZjEzYjkxIDEwMDY0NAo+Pj4+IC0tLSBhL2luY2x1 ZGUvZHJtL2RybV9hdG9taWMuaAo+Pj4+ICsrKyBiL2luY2x1ZGUvZHJtL2RybV9hdG9taWMuaAo+ Pj4+IEBAIC03NywyNiArNzcsMjYgQEAgaW50IF9fbXVzdF9jaGVjayBkcm1fYXRvbWljX2FzeW5j X2NvbW1pdChzdHJ1Y3QgZHJtX2F0b21pY19zdGF0ZSAqc3RhdGUpOwo+Pj4+ICAKPj4+PiAgI2Rl ZmluZSBmb3JfZWFjaF9jb25uZWN0b3JfaW5fc3RhdGUoc3RhdGUsIGNvbm5lY3RvciwgY29ubmVj dG9yX3N0YXRlLCBfX2kpIFwKPj4+PiAgCWZvciAoKF9faSkgPSAwOwkJCQkJCQlcCj4+Pj4gLQkg ICAgIChjb25uZWN0b3IpID0gKHN0YXRlKS0+Y29ubmVjdG9yc1tfX2ldLAkJCVwKPj4+PiAtCSAg ICAgKGNvbm5lY3Rvcl9zdGF0ZSkgPSAoc3RhdGUpLT5jb25uZWN0b3Jfc3RhdGVzW19faV0sCVwK Pj4+PiAtCSAgICAgKF9faSkgPCAoc3RhdGUpLT5udW1fY29ubmVjdG9yOwkJCQlcCj4+Pj4gKwkg ICAgIChfX2kpIDwgKHN0YXRlKS0+bnVtX2Nvbm5lY3RvciAmJgkJCQlcCj4+Pj4gKwkgICAgICgo Y29ubmVjdG9yKSA9IChzdGF0ZSktPmNvbm5lY3RvcnNbX19pXSwJCQlcCj4+Pj4gKwkgICAgIChj b25uZWN0b3Jfc3RhdGUpID0gKHN0YXRlKS0+Y29ubmVjdG9yX3N0YXRlc1tfX2ldLCAxKTsgCVwK Pj4+IAo+Pj4gVGhpcyB3aWxsIHN0b3AgYXQgdGhlIGZpcnN0IE5VTEwgY29ubmVjdG9yL2Nvbm5l Y3Rvcl9zdGF0ZS4gU2ltaWxhcmx5Cj4+PiBmb3IgdGhlIGxvb3BzIGJlbG93Lgo+Pj4gCj4+Cj4+ IFRoaXMgd2lsbCBzdG9wIGlmZiAoX19pKSA+PSAoc3RhdGUpLT5udW1fY29ubmVjdG9yLCBiZWNh dXNlIHRoZSByZXN1bHQgb2YgZXhwcmVzc2lvbjoKPj4gCSAoKGNvbm5lY3RvcikgPSAoc3RhdGUp LT5jb25uZWN0b3JzW19faV0sIChjb25uZWN0b3Jfc3RhdGUpID0gKHN0YXRlKS0+Y29ubmVjdG9y X3N0YXRlc1tfX2ldLCAxKQo+PiBpcyBhbHdheXMgMS4KPgo+IFdoeSBkbyB5b3UgdGhpbmsgaXQn bGwgYWx3YXlzIGJlIDE/CgpUaGF0IG1pZ2h0IGJlIGJlY2F1c2UgdGhlcmUncyB0aGUgMSBhdCB0 aGUgZW5kLiAqYmx1c2gqLgoKSSBkbyB3b25kZXIgaWYgdGhpcyBpcyB0b28gc3VidGxlIGluIGdl bmVyYWwsIG9yIGlmIGl0J3MganVzdCB0b28gc3VidGxlCmZvciBtZS4KCkJSLApKYW5pLgoKPgo+ IEJSLAo+IEphbmkuCj4KPgo+Pgo+Pgo+Cj4gLS0gCj4gSmFuaSBOaWt1bGEsIEludGVsIE9wZW4g U291cmNlIFRlY2hub2xvZ3kgQ2VudGVyCgotLSAKSmFuaSBOaWt1bGEsIEludGVsIE9wZW4gU291 cmNlIFRlY2hub2xvZ3kgQ2VudGVyCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fCmRyaS1kZXZlbCBtYWlsaW5nIGxpc3QKZHJpLWRldmVsQGxpc3RzLmZyZWVk ZXNrdG9wLm9yZwpodHRwOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8v ZHJpLWRldmVsCg== From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751338AbbEYNuX (ORCPT ); Mon, 25 May 2015 09:50:23 -0400 Received: from mga02.intel.com ([134.134.136.20]:21624 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751026AbbEYNuW (ORCPT ); Mon, 25 May 2015 09:50:22 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.13,491,1427785200"; d="scan'208";a="731351382" From: Jani Nikula To: Andrey Ryabinin , David Airlie Cc: Ander Conselvan de Oliveira , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Subject: Re: [PATCH] drm/atomic: fix out of bounds read in for_each_*_in_state helpers In-Reply-To: <87lhgcix4s.fsf@intel.com> Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo References: <1432549784-21966-1-git-send-email-a.ryabinin@samsung.com> <87oal8iyxh.fsf@intel.com> <556322E6.3020500@samsung.com> <87lhgcix4s.fsf@intel.com> User-Agent: Notmuch/0.19+112~g77230b0 (http://notmuchmail.org) Emacs/24.4.1 (x86_64-pc-linux-gnu) Date: Mon, 25 May 2015 16:52:31 +0300 Message-ID: <87iobgix28.fsf@intel.com> MIME-Version: 1.0 Content-Type: text/plain Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 25 May 2015, Jani Nikula wrote: > On Mon, 25 May 2015, Andrey Ryabinin wrote: >> On 05/25/2015 04:12 PM, Jani Nikula wrote: >>> On Mon, 25 May 2015, Andrey Ryabinin wrote: >>>> for_each_*_in_state validate array index after >>>> access to array elements, thus perform out of bounds read. >>>> >>>> Fix this by validating index in the first place and read >>>> array element iff validation was successful. >>>> >>>> Fixes: df63b9994eaf ("drm/atomic: Add for_each_{connector,crtc,plane}_in_state helper macros") >>>> Signed-off-by: Andrey Ryabinin >>>> --- >>>> include/drm/drm_atomic.h | 24 ++++++++++++------------ >>>> 1 file changed, 12 insertions(+), 12 deletions(-) >>>> >>>> diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h >>>> index c1571034..3f13b91 100644 >>>> --- a/include/drm/drm_atomic.h >>>> +++ b/include/drm/drm_atomic.h >>>> @@ -77,26 +77,26 @@ int __must_check drm_atomic_async_commit(struct drm_atomic_state *state); >>>> >>>> #define for_each_connector_in_state(state, connector, connector_state, __i) \ >>>> for ((__i) = 0; \ >>>> - (connector) = (state)->connectors[__i], \ >>>> - (connector_state) = (state)->connector_states[__i], \ >>>> - (__i) < (state)->num_connector; \ >>>> + (__i) < (state)->num_connector && \ >>>> + ((connector) = (state)->connectors[__i], \ >>>> + (connector_state) = (state)->connector_states[__i], 1); \ >>> >>> This will stop at the first NULL connector/connector_state. Similarly >>> for the loops below. >>> >> >> This will stop iff (__i) >= (state)->num_connector, because the result of expression: >> ((connector) = (state)->connectors[__i], (connector_state) = (state)->connector_states[__i], 1) >> is always 1. > > Why do you think it'll always be 1? That might be because there's the 1 at the end. *blush*. I do wonder if this is too subtle in general, or if it's just too subtle for me. BR, Jani. > > BR, > Jani. > > >> >> > > -- > Jani Nikula, Intel Open Source Technology Center -- Jani Nikula, Intel Open Source Technology Center