From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jani Nikula Subject: Re: [PATCH] drm/atomic: fix out of bounds read in for_each_*_in_state helpers Date: Mon, 25 May 2015 16:12:10 +0300 Message-ID: <87oal8iyxh.fsf@intel.com> References: <1432549784-21966-1-git-send-email-a.ryabinin@samsung.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by gabe.freedesktop.org (Postfix) with ESMTP id 0F02C6E012 for ; Mon, 25 May 2015 06:10:00 -0700 (PDT) In-Reply-To: <1432549784-21966-1-git-send-email-a.ryabinin@samsung.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: David Airlie Cc: Andrey Ryabinin , Ander Conselvan de Oliveira , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org T24gTW9uLCAyNSBNYXkgMjAxNSwgQW5kcmV5IFJ5YWJpbmluIDxhLnJ5YWJpbmluQHNhbXN1bmcu Y29tPiB3cm90ZToKPiBmb3JfZWFjaF8qX2luX3N0YXRlIHZhbGlkYXRlIGFycmF5IGluZGV4IGFm dGVyCj4gYWNjZXNzIHRvIGFycmF5IGVsZW1lbnRzLCB0aHVzIHBlcmZvcm0gb3V0IG9mIGJvdW5k cyByZWFkLgo+Cj4gRml4IHRoaXMgYnkgdmFsaWRhdGluZyBpbmRleCBpbiB0aGUgZmlyc3QgcGxh Y2UgYW5kIHJlYWQKPiBhcnJheSBlbGVtZW50IGlmZiB2YWxpZGF0aW9uIHdhcyBzdWNjZXNzZnVs Lgo+Cj4gRml4ZXM6IGRmNjNiOTk5NGVhZiAoImRybS9hdG9taWM6IEFkZCBmb3JfZWFjaF97Y29u bmVjdG9yLGNydGMscGxhbmV9X2luX3N0YXRlIGhlbHBlciBtYWNyb3MiKQo+IFNpZ25lZC1vZmYt Ynk6IEFuZHJleSBSeWFiaW5pbiA8YS5yeWFiaW5pbkBzYW1zdW5nLmNvbT4KPiAtLS0KPiAgaW5j bHVkZS9kcm0vZHJtX2F0b21pYy5oIHwgMjQgKysrKysrKysrKysrLS0tLS0tLS0tLS0tCj4gIDEg ZmlsZSBjaGFuZ2VkLCAxMiBpbnNlcnRpb25zKCspLCAxMiBkZWxldGlvbnMoLSkKPgo+IGRpZmYg LS1naXQgYS9pbmNsdWRlL2RybS9kcm1fYXRvbWljLmggYi9pbmNsdWRlL2RybS9kcm1fYXRvbWlj LmgKPiBpbmRleCBjMTU3MTAzNC4uM2YxM2I5MSAxMDA2NDQKPiAtLS0gYS9pbmNsdWRlL2RybS9k cm1fYXRvbWljLmgKPiArKysgYi9pbmNsdWRlL2RybS9kcm1fYXRvbWljLmgKPiBAQCAtNzcsMjYg Kzc3LDI2IEBAIGludCBfX211c3RfY2hlY2sgZHJtX2F0b21pY19hc3luY19jb21taXQoc3RydWN0 IGRybV9hdG9taWNfc3RhdGUgKnN0YXRlKTsKPiAgCj4gICNkZWZpbmUgZm9yX2VhY2hfY29ubmVj dG9yX2luX3N0YXRlKHN0YXRlLCBjb25uZWN0b3IsIGNvbm5lY3Rvcl9zdGF0ZSwgX19pKSBcCj4g IAlmb3IgKChfX2kpID0gMDsJCQkJCQkJXAo+IC0JICAgICAoY29ubmVjdG9yKSA9IChzdGF0ZSkt PmNvbm5lY3RvcnNbX19pXSwJCQlcCj4gLQkgICAgIChjb25uZWN0b3Jfc3RhdGUpID0gKHN0YXRl KS0+Y29ubmVjdG9yX3N0YXRlc1tfX2ldLAlcCj4gLQkgICAgIChfX2kpIDwgKHN0YXRlKS0+bnVt X2Nvbm5lY3RvcjsJCQkJXAo+ICsJICAgICAoX19pKSA8IChzdGF0ZSktPm51bV9jb25uZWN0b3Ig JiYJCQkJXAo+ICsJICAgICAoKGNvbm5lY3RvcikgPSAoc3RhdGUpLT5jb25uZWN0b3JzW19faV0s CQkJXAo+ICsJICAgICAoY29ubmVjdG9yX3N0YXRlKSA9IChzdGF0ZSktPmNvbm5lY3Rvcl9zdGF0 ZXNbX19pXSwgMSk7IAlcCgpUaGlzIHdpbGwgc3RvcCBhdCB0aGUgZmlyc3QgTlVMTCBjb25uZWN0 b3IvY29ubmVjdG9yX3N0YXRlLiBTaW1pbGFybHkKZm9yIHRoZSBsb29wcyBiZWxvdy4KCkJSLApK YW5pLgoKPiAgCSAgICAgKF9faSkrKykJCQkJCQkJXAo+ICAJCWlmIChjb25uZWN0b3IpCj4gIAo+ ICAjZGVmaW5lIGZvcl9lYWNoX2NydGNfaW5fc3RhdGUoc3RhdGUsIGNydGMsIGNydGNfc3RhdGUs IF9faSkJXAo+ICAJZm9yICgoX19pKSA9IDA7CQkJCQkJXAo+IC0JICAgICAoY3J0YykgPSAoc3Rh dGUpLT5jcnRjc1tfX2ldLAkJCVwKPiAtCSAgICAgKGNydGNfc3RhdGUpID0gKHN0YXRlKS0+Y3J0 Y19zdGF0ZXNbX19pXSwJCVwKPiAtCSAgICAgKF9faSkgPCAoc3RhdGUpLT5kZXYtPm1vZGVfY29u ZmlnLm51bV9jcnRjOwlcCj4gKwkgICAgIChfX2kpIDwgKHN0YXRlKS0+ZGV2LT5tb2RlX2NvbmZp Zy5udW1fY3J0YyAmJglcCj4gKwkgICAgICgoY3J0YykgPSAoc3RhdGUpLT5jcnRjc1tfX2ldLAkJ CVwKPiArCSAgICAgKGNydGNfc3RhdGUpID0gKHN0YXRlKS0+Y3J0Y19zdGF0ZXNbX19pXSwgMSk7 CVwKPiAgCSAgICAgKF9faSkrKykJCQkJCQlcCj4gIAkJaWYgKGNydGNfc3RhdGUpCj4gIAo+IC0j ZGVmaW5lIGZvcl9lYWNoX3BsYW5lX2luX3N0YXRlKHN0YXRlLCBwbGFuZSwgcGxhbmVfc3RhdGUs IF9faSkJXAo+IC0JZm9yICgoX19pKSA9IDA7CQkJCQkJXAo+IC0JICAgICAocGxhbmUpID0gKHN0 YXRlKS0+cGxhbmVzW19faV0sCQkJXAo+IC0JICAgICAocGxhbmVfc3RhdGUpID0gKHN0YXRlKS0+ cGxhbmVfc3RhdGVzW19faV0sCVwKPiAtCSAgICAgKF9faSkgPCAoc3RhdGUpLT5kZXYtPm1vZGVf Y29uZmlnLm51bV90b3RhbF9wbGFuZTsJXAo+IC0JICAgICAoX19pKSsrKQkJCQkJCVwKPiArI2Rl ZmluZSBmb3JfZWFjaF9wbGFuZV9pbl9zdGF0ZShzdGF0ZSwgcGxhbmUsIHBsYW5lX3N0YXRlLCBf X2kpCQlcCj4gKwlmb3IgKChfX2kpID0gMDsJCQkJCQkJXAo+ICsJICAgICAoX19pKSA8IChzdGF0 ZSktPmRldi0+bW9kZV9jb25maWcubnVtX3RvdGFsX3BsYW5lICYmCVwKPiArCSAgICAgKChwbGFu ZSkgPSAoc3RhdGUpLT5wbGFuZXNbX19pXSwJCQkJXAo+ICsJICAgICAocGxhbmVfc3RhdGUpID0g KHN0YXRlKS0+cGxhbmVfc3RhdGVzW19faV0sIDEpOwkJXAo+ICsJICAgICAoX19pKSsrKQkJCQkJ CQlcCj4gIAkJaWYgKHBsYW5lX3N0YXRlKQo+ICAKPiAgI2VuZGlmIC8qIERSTV9BVE9NSUNfSF8g Ki8KPiAtLSAKPiAyLjQuMQo+Cj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18KPiBkcmktZGV2ZWwgbWFpbGluZyBsaXN0Cj4gZHJpLWRldmVsQGxpc3RzLmZy ZWVkZXNrdG9wLm9yZwo+IGh0dHA6Ly9saXN0cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0 aW5mby9kcmktZGV2ZWwKCi0tIApKYW5pIE5pa3VsYSwgSW50ZWwgT3BlbiBTb3VyY2UgVGVjaG5v bG9neSBDZW50ZXIKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18KZHJpLWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3Jn Cmh0dHA6Ly9saXN0cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9kcmktZGV2ZWwK From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751230AbbEYNKD (ORCPT ); Mon, 25 May 2015 09:10:03 -0400 Received: from mga03.intel.com ([134.134.136.65]:31906 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750910AbbEYNJ7 (ORCPT ); Mon, 25 May 2015 09:09:59 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.13,491,1427785200"; d="scan'208";a="731336632" From: Jani Nikula To: Andrey Ryabinin , David Airlie Cc: Andrey Ryabinin , Ander Conselvan de Oliveira , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Subject: Re: [PATCH] drm/atomic: fix out of bounds read in for_each_*_in_state helpers In-Reply-To: <1432549784-21966-1-git-send-email-a.ryabinin@samsung.com> Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo References: <1432549784-21966-1-git-send-email-a.ryabinin@samsung.com> User-Agent: Notmuch/0.19+112~g77230b0 (http://notmuchmail.org) Emacs/24.4.1 (x86_64-pc-linux-gnu) Date: Mon, 25 May 2015 16:12:10 +0300 Message-ID: <87oal8iyxh.fsf@intel.com> MIME-Version: 1.0 Content-Type: text/plain Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 25 May 2015, Andrey Ryabinin wrote: > for_each_*_in_state validate array index after > access to array elements, thus perform out of bounds read. > > Fix this by validating index in the first place and read > array element iff validation was successful. > > Fixes: df63b9994eaf ("drm/atomic: Add for_each_{connector,crtc,plane}_in_state helper macros") > Signed-off-by: Andrey Ryabinin > --- > include/drm/drm_atomic.h | 24 ++++++++++++------------ > 1 file changed, 12 insertions(+), 12 deletions(-) > > diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h > index c1571034..3f13b91 100644 > --- a/include/drm/drm_atomic.h > +++ b/include/drm/drm_atomic.h > @@ -77,26 +77,26 @@ int __must_check drm_atomic_async_commit(struct drm_atomic_state *state); > > #define for_each_connector_in_state(state, connector, connector_state, __i) \ > for ((__i) = 0; \ > - (connector) = (state)->connectors[__i], \ > - (connector_state) = (state)->connector_states[__i], \ > - (__i) < (state)->num_connector; \ > + (__i) < (state)->num_connector && \ > + ((connector) = (state)->connectors[__i], \ > + (connector_state) = (state)->connector_states[__i], 1); \ This will stop at the first NULL connector/connector_state. Similarly for the loops below. BR, Jani. > (__i)++) \ > if (connector) > > #define for_each_crtc_in_state(state, crtc, crtc_state, __i) \ > for ((__i) = 0; \ > - (crtc) = (state)->crtcs[__i], \ > - (crtc_state) = (state)->crtc_states[__i], \ > - (__i) < (state)->dev->mode_config.num_crtc; \ > + (__i) < (state)->dev->mode_config.num_crtc && \ > + ((crtc) = (state)->crtcs[__i], \ > + (crtc_state) = (state)->crtc_states[__i], 1); \ > (__i)++) \ > if (crtc_state) > > -#define for_each_plane_in_state(state, plane, plane_state, __i) \ > - for ((__i) = 0; \ > - (plane) = (state)->planes[__i], \ > - (plane_state) = (state)->plane_states[__i], \ > - (__i) < (state)->dev->mode_config.num_total_plane; \ > - (__i)++) \ > +#define for_each_plane_in_state(state, plane, plane_state, __i) \ > + for ((__i) = 0; \ > + (__i) < (state)->dev->mode_config.num_total_plane && \ > + ((plane) = (state)->planes[__i], \ > + (plane_state) = (state)->plane_states[__i], 1); \ > + (__i)++) \ > if (plane_state) > > #endif /* DRM_ATOMIC_H_ */ > -- > 2.4.1 > > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > http://lists.freedesktop.org/mailman/listinfo/dri-devel -- Jani Nikula, Intel Open Source Technology Center