From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jani Nikula Subject: Re: [PATCH] drm/atomic: fix out of bounds read in for_each_*_in_state helpers Date: Mon, 25 May 2015 16:50:59 +0300 Message-ID: <87lhgcix4s.fsf@intel.com> References: <1432549784-21966-1-git-send-email-a.ryabinin@samsung.com> <87oal8iyxh.fsf@intel.com> <556322E6.3020500@samsung.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by gabe.freedesktop.org (Postfix) with ESMTP id 9F7E06E479 for ; Mon, 25 May 2015 06:48:47 -0700 (PDT) In-Reply-To: <556322E6.3020500@samsung.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Andrey Ryabinin , David Airlie Cc: Ander Conselvan de Oliveira , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org T24gTW9uLCAyNSBNYXkgMjAxNSwgQW5kcmV5IFJ5YWJpbmluIDxhLnJ5YWJpbmluQHNhbXN1bmcu Y29tPiB3cm90ZToKPiBPbiAwNS8yNS8yMDE1IDA0OjEyIFBNLCBKYW5pIE5pa3VsYSB3cm90ZToK Pj4gT24gTW9uLCAyNSBNYXkgMjAxNSwgQW5kcmV5IFJ5YWJpbmluIDxhLnJ5YWJpbmluQHNhbXN1 bmcuY29tPiB3cm90ZToKPj4+IGZvcl9lYWNoXypfaW5fc3RhdGUgdmFsaWRhdGUgYXJyYXkgaW5k ZXggYWZ0ZXIKPj4+IGFjY2VzcyB0byBhcnJheSBlbGVtZW50cywgdGh1cyBwZXJmb3JtIG91dCBv ZiBib3VuZHMgcmVhZC4KPj4+Cj4+PiBGaXggdGhpcyBieSB2YWxpZGF0aW5nIGluZGV4IGluIHRo ZSBmaXJzdCBwbGFjZSBhbmQgcmVhZAo+Pj4gYXJyYXkgZWxlbWVudCBpZmYgdmFsaWRhdGlvbiB3 YXMgc3VjY2Vzc2Z1bC4KPj4+Cj4+PiBGaXhlczogZGY2M2I5OTk0ZWFmICgiZHJtL2F0b21pYzog QWRkIGZvcl9lYWNoX3tjb25uZWN0b3IsY3J0YyxwbGFuZX1faW5fc3RhdGUgaGVscGVyIG1hY3Jv cyIpCj4+PiBTaWduZWQtb2ZmLWJ5OiBBbmRyZXkgUnlhYmluaW4gPGEucnlhYmluaW5Ac2Ftc3Vu Zy5jb20+Cj4+PiAtLS0KPj4+ICBpbmNsdWRlL2RybS9kcm1fYXRvbWljLmggfCAyNCArKysrKysr KysrKystLS0tLS0tLS0tLS0KPj4+ICAxIGZpbGUgY2hhbmdlZCwgMTIgaW5zZXJ0aW9ucygrKSwg MTIgZGVsZXRpb25zKC0pCj4+Pgo+Pj4gZGlmZiAtLWdpdCBhL2luY2x1ZGUvZHJtL2RybV9hdG9t aWMuaCBiL2luY2x1ZGUvZHJtL2RybV9hdG9taWMuaAo+Pj4gaW5kZXggYzE1NzEwMzQuLjNmMTNi OTEgMTAwNjQ0Cj4+PiAtLS0gYS9pbmNsdWRlL2RybS9kcm1fYXRvbWljLmgKPj4+ICsrKyBiL2lu Y2x1ZGUvZHJtL2RybV9hdG9taWMuaAo+Pj4gQEAgLTc3LDI2ICs3NywyNiBAQCBpbnQgX19tdXN0 X2NoZWNrIGRybV9hdG9taWNfYXN5bmNfY29tbWl0KHN0cnVjdCBkcm1fYXRvbWljX3N0YXRlICpz dGF0ZSk7Cj4+PiAgCj4+PiAgI2RlZmluZSBmb3JfZWFjaF9jb25uZWN0b3JfaW5fc3RhdGUoc3Rh dGUsIGNvbm5lY3RvciwgY29ubmVjdG9yX3N0YXRlLCBfX2kpIFwKPj4+ICAJZm9yICgoX19pKSA9 IDA7CQkJCQkJCVwKPj4+IC0JICAgICAoY29ubmVjdG9yKSA9IChzdGF0ZSktPmNvbm5lY3RvcnNb X19pXSwJCQlcCj4+PiAtCSAgICAgKGNvbm5lY3Rvcl9zdGF0ZSkgPSAoc3RhdGUpLT5jb25uZWN0 b3Jfc3RhdGVzW19faV0sCVwKPj4+IC0JICAgICAoX19pKSA8IChzdGF0ZSktPm51bV9jb25uZWN0 b3I7CQkJCVwKPj4+ICsJICAgICAoX19pKSA8IChzdGF0ZSktPm51bV9jb25uZWN0b3IgJiYJCQkJ XAo+Pj4gKwkgICAgICgoY29ubmVjdG9yKSA9IChzdGF0ZSktPmNvbm5lY3RvcnNbX19pXSwJCQlc Cj4+PiArCSAgICAgKGNvbm5lY3Rvcl9zdGF0ZSkgPSAoc3RhdGUpLT5jb25uZWN0b3Jfc3RhdGVz W19faV0sIDEpOyAJXAo+PiAKPj4gVGhpcyB3aWxsIHN0b3AgYXQgdGhlIGZpcnN0IE5VTEwgY29u bmVjdG9yL2Nvbm5lY3Rvcl9zdGF0ZS4gU2ltaWxhcmx5Cj4+IGZvciB0aGUgbG9vcHMgYmVsb3cu Cj4+IAo+Cj4gVGhpcyB3aWxsIHN0b3AgaWZmIChfX2kpID49IChzdGF0ZSktPm51bV9jb25uZWN0 b3IsIGJlY2F1c2UgdGhlIHJlc3VsdCBvZiBleHByZXNzaW9uOgo+IAkgKChjb25uZWN0b3IpID0g KHN0YXRlKS0+Y29ubmVjdG9yc1tfX2ldLCAoY29ubmVjdG9yX3N0YXRlKSA9IChzdGF0ZSktPmNv bm5lY3Rvcl9zdGF0ZXNbX19pXSwgMSkKPiBpcyBhbHdheXMgMS4KCldoeSBkbyB5b3UgdGhpbmsg aXQnbGwgYWx3YXlzIGJlIDE/CgpCUiwKSmFuaS4KCgo+Cj4KCi0tIApKYW5pIE5pa3VsYSwgSW50 ZWwgT3BlbiBTb3VyY2UgVGVjaG5vbG9neSBDZW50ZXIKX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2ZWxA bGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHA6Ly9saXN0cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1h bi9saXN0aW5mby9kcmktZGV2ZWwK From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751141AbbEYNsx (ORCPT ); Mon, 25 May 2015 09:48:53 -0400 Received: from mga09.intel.com ([134.134.136.24]:50888 "EHLO mga09.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750800AbbEYNsw (ORCPT ); Mon, 25 May 2015 09:48:52 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.13,491,1427785200"; d="scan'208";a="731350862" From: Jani Nikula To: Andrey Ryabinin , David Airlie Cc: Ander Conselvan de Oliveira , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Subject: Re: [PATCH] drm/atomic: fix out of bounds read in for_each_*_in_state helpers In-Reply-To: <556322E6.3020500@samsung.com> Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo References: <1432549784-21966-1-git-send-email-a.ryabinin@samsung.com> <87oal8iyxh.fsf@intel.com> <556322E6.3020500@samsung.com> User-Agent: Notmuch/0.19+112~g77230b0 (http://notmuchmail.org) Emacs/24.4.1 (x86_64-pc-linux-gnu) Date: Mon, 25 May 2015 16:50:59 +0300 Message-ID: <87lhgcix4s.fsf@intel.com> MIME-Version: 1.0 Content-Type: text/plain Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 25 May 2015, Andrey Ryabinin wrote: > On 05/25/2015 04:12 PM, Jani Nikula wrote: >> On Mon, 25 May 2015, Andrey Ryabinin wrote: >>> for_each_*_in_state validate array index after >>> access to array elements, thus perform out of bounds read. >>> >>> Fix this by validating index in the first place and read >>> array element iff validation was successful. >>> >>> Fixes: df63b9994eaf ("drm/atomic: Add for_each_{connector,crtc,plane}_in_state helper macros") >>> Signed-off-by: Andrey Ryabinin >>> --- >>> include/drm/drm_atomic.h | 24 ++++++++++++------------ >>> 1 file changed, 12 insertions(+), 12 deletions(-) >>> >>> diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h >>> index c1571034..3f13b91 100644 >>> --- a/include/drm/drm_atomic.h >>> +++ b/include/drm/drm_atomic.h >>> @@ -77,26 +77,26 @@ int __must_check drm_atomic_async_commit(struct drm_atomic_state *state); >>> >>> #define for_each_connector_in_state(state, connector, connector_state, __i) \ >>> for ((__i) = 0; \ >>> - (connector) = (state)->connectors[__i], \ >>> - (connector_state) = (state)->connector_states[__i], \ >>> - (__i) < (state)->num_connector; \ >>> + (__i) < (state)->num_connector && \ >>> + ((connector) = (state)->connectors[__i], \ >>> + (connector_state) = (state)->connector_states[__i], 1); \ >> >> This will stop at the first NULL connector/connector_state. Similarly >> for the loops below. >> > > This will stop iff (__i) >= (state)->num_connector, because the result of expression: > ((connector) = (state)->connectors[__i], (connector_state) = (state)->connector_states[__i], 1) > is always 1. Why do you think it'll always be 1? BR, Jani. > > -- Jani Nikula, Intel Open Source Technology Center