All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/xe/rtp: Fix out-of-bounds array access
@ 2024-06-28 16:17 Lucas De Marchi
  2024-06-28 18:41 ` Rodrigo Vivi
                   ` (9 more replies)
  0 siblings, 10 replies; 12+ messages in thread
From: Lucas De Marchi @ 2024-06-28 16:17 UTC (permalink / raw)
  To: intel-xe; +Cc: Lucas De Marchi, Mika Kuoppala

Increment the counter before checking for number of rules, otherwise
when there's no XE_RTP_MATCH_OR an out-of-bounds access is done, as
reported by kasan:

	BUG: KASAN: global-out-of-bounds in rule_matches+0xb6d/0x11c0 [xe]
	Read of size 1 at addr ffffffffa0a50b70 by task systemd-udevd/243

Fixes: dc72c52a42e0 ("drm/xe/rtp: Allow to OR rules")
Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
---
 drivers/gpu/drm/xe/xe_rtp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_rtp.c b/drivers/gpu/drm/xe/xe_rtp.c
index 5b27f7c45ea3..02e28274282f 100644
--- a/drivers/gpu/drm/xe/xe_rtp.c
+++ b/drivers/gpu/drm/xe/xe_rtp.c
@@ -121,7 +121,7 @@ static bool rule_matches(const struct xe_device *xe,
 			 * Advance rules until we find XE_RTP_MATCH_OR to check
 			 * if there's another set of conditions to check
 			 */
-			while (i < n_rules && rules[++i].match_type != XE_RTP_MATCH_OR)
+			while (++i < n_rules && rules[i].match_type != XE_RTP_MATCH_OR)
 				;
 
 			if (i >= n_rules)
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 12+ messages in thread

end of thread, other threads:[~2024-07-01 19:29 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-28 16:17 [PATCH] drm/xe/rtp: Fix out-of-bounds array access Lucas De Marchi
2024-06-28 18:41 ` Rodrigo Vivi
2024-07-01 19:28   ` Lucas De Marchi
2024-07-01  2:19 ` ✓ CI.Patch_applied: success for drm/xe/rtp: Fix out-of-bounds array access (rev2) Patchwork
2024-07-01  2:19 ` ✓ CI.checkpatch: " Patchwork
2024-07-01  2:20 ` ✓ CI.KUnit: " Patchwork
2024-07-01  2:32 ` ✓ CI.Build: " Patchwork
2024-07-01  2:34 ` ✓ CI.Hooks: " Patchwork
2024-07-01  2:35 ` ✓ CI.checksparse: " Patchwork
2024-07-01  2:58 ` ✓ CI.BAT: " Patchwork
2024-07-01  3:59 ` ✗ CI.FULL: failure " Patchwork
2024-07-01 15:58 ` [PATCH] drm/xe/rtp: Fix out-of-bounds array access Nirmoy Das

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.