From mboxrd@z Thu Jan 1 00:00:00 1970 From: Zhenyu Wang Subject: Re: [PATCH] drm/i915/gvt/fb_decoder: Fix out-of-bounds read Date: Mon, 11 Dec 2017 17:20:51 +0800 Message-ID: <20171211092051.stm4eeoa5beigs6d@zhen-hp.sh.intel.com> References: <20171209063759.GA8672@embeddedor.com> Reply-To: Zhenyu Wang Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1016403132==" Return-path: In-Reply-To: <20171209063759.GA8672@embeddedor.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" To: "Gustavo A. R. Silva" Cc: David Airlie , intel-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, Rodrigo Vivi , intel-gvt-dev@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============1016403132== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="5ixjydgjgwe2cenj" Content-Disposition: inline --5ixjydgjgwe2cenj Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2017.12.09 00:37:59 -0600, Gustavo A. R. Silva wrote: > In case function skl_format_to_drm returns -EINVAL, fmt turns into a huge > number as fmt is of type u32, hence there is an out-of-bounds read when > using fmt as an index for array skl_pixel_formats at line 225: > plane->bpp =3D skl_pixel_formats[fmt].bpp; >=20 > Fix this by comparing the value returned by function skl_format_to_drm > against the size of array skl_pixel_formats, so in case it is greater than > or equal to the number of items contained in skl_pixel_formats, print an > error message and return -EINVAL. >=20 > Addresses-Coverity-ID: 1462495 > Addresses-Coverity-ID: 1462502 ("Out-of-bounds read") > Fixes: 9f31d1063b43 ("drm/i915/gvt: Add framebuffer decoder support") > Signed-off-by: Gustavo A. R. Silva > --- > drivers/gpu/drm/i915/gvt/fb_decoder.c | 6 ++++++ > 1 file changed, 6 insertions(+) >=20 > diff --git a/drivers/gpu/drm/i915/gvt/fb_decoder.c b/drivers/gpu/drm/i915= /gvt/fb_decoder.c > index 72f4217..aed578b 100644 > --- a/drivers/gpu/drm/i915/gvt/fb_decoder.c > +++ b/drivers/gpu/drm/i915/gvt/fb_decoder.c > @@ -222,6 +222,12 @@ int intel_vgpu_decode_primary_plane(struct intel_vgp= u *vgpu, > val & PLANE_CTL_ORDER_RGBX, > val & PLANE_CTL_ALPHA_MASK, > val & PLANE_CTL_YUV422_ORDER_MASK); > + > + if (fmt >=3D ARRAY_SIZE(skl_pixel_formats)) { > + gvt_vgpu_err("Out-of-bounds pixel format index\n"); > + return -EINVAL; > + } > + > plane->bpp =3D skl_pixel_formats[fmt].bpp; > plane->drm_format =3D skl_pixel_formats[fmt].drm_format; > } else { > --=20 Applied this, thanks! --=20 Open Source Technology Center, Intel ltd. $gpg --keyserver wwwkeys.pgp.net --recv-keys 4D781827 --5ixjydgjgwe2cenj Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQTXuabgHDW6LPt9CICxBBozTXgYJwUCWi5N8wAKCRCxBBozTXgY J+MlAJwLxwROZP87eJHvPrZbeRzGEU6pMgCffeC0j9BxU+t9vpnmsC9u6jyUzOs= =xy7E -----END PGP SIGNATURE----- --5ixjydgjgwe2cenj-- --===============1016403132== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KSW50ZWwtZ2Z4 IG1haWxpbmcgbGlzdApJbnRlbC1nZnhAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlz dHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vaW50ZWwtZ2Z4Cg== --===============1016403132==--