From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752630AbdLKJ1F (ORCPT ); Mon, 11 Dec 2017 04:27:05 -0500 Received: from mga11.intel.com ([192.55.52.93]:45590 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752564AbdLKJ07 (ORCPT ); Mon, 11 Dec 2017 04:26:59 -0500 X-Amp-Result: UNKNOWN X-Amp-Original-Verdict: FILE UNKNOWN X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,391,1508828400"; d="asc'?scan'208";a="1588818" Date: Mon, 11 Dec 2017 17:20:51 +0800 From: Zhenyu Wang To: "Gustavo A. R. Silva" Cc: Zhi Wang , Jani Nikula , Joonas Lahtinen , Rodrigo Vivi , David Airlie , intel-gfx@lists.freedesktop.org, intel-gvt-dev@lists.freedesktop.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Subject: Re: [PATCH] drm/i915/gvt/fb_decoder: Fix out-of-bounds read Message-ID: <20171211092051.stm4eeoa5beigs6d@zhen-hp.sh.intel.com> Reply-To: Zhenyu Wang References: <20171209063759.GA8672@embeddedor.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="5ixjydgjgwe2cenj" Content-Disposition: inline In-Reply-To: <20171209063759.GA8672@embeddedor.com> User-Agent: NeoMutt/20170609 (1.8.3) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --5ixjydgjgwe2cenj Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2017.12.09 00:37:59 -0600, Gustavo A. R. Silva wrote: > In case function skl_format_to_drm returns -EINVAL, fmt turns into a huge > number as fmt is of type u32, hence there is an out-of-bounds read when > using fmt as an index for array skl_pixel_formats at line 225: > plane->bpp =3D skl_pixel_formats[fmt].bpp; >=20 > Fix this by comparing the value returned by function skl_format_to_drm > against the size of array skl_pixel_formats, so in case it is greater than > or equal to the number of items contained in skl_pixel_formats, print an > error message and return -EINVAL. >=20 > Addresses-Coverity-ID: 1462495 > Addresses-Coverity-ID: 1462502 ("Out-of-bounds read") > Fixes: 9f31d1063b43 ("drm/i915/gvt: Add framebuffer decoder support") > Signed-off-by: Gustavo A. R. Silva > --- > drivers/gpu/drm/i915/gvt/fb_decoder.c | 6 ++++++ > 1 file changed, 6 insertions(+) >=20 > diff --git a/drivers/gpu/drm/i915/gvt/fb_decoder.c b/drivers/gpu/drm/i915= /gvt/fb_decoder.c > index 72f4217..aed578b 100644 > --- a/drivers/gpu/drm/i915/gvt/fb_decoder.c > +++ b/drivers/gpu/drm/i915/gvt/fb_decoder.c > @@ -222,6 +222,12 @@ int intel_vgpu_decode_primary_plane(struct intel_vgp= u *vgpu, > val & PLANE_CTL_ORDER_RGBX, > val & PLANE_CTL_ALPHA_MASK, > val & PLANE_CTL_YUV422_ORDER_MASK); > + > + if (fmt >=3D ARRAY_SIZE(skl_pixel_formats)) { > + gvt_vgpu_err("Out-of-bounds pixel format index\n"); > + return -EINVAL; > + } > + > plane->bpp =3D skl_pixel_formats[fmt].bpp; > plane->drm_format =3D skl_pixel_formats[fmt].drm_format; > } else { > --=20 Applied this, thanks! --=20 Open Source Technology Center, Intel ltd. $gpg --keyserver wwwkeys.pgp.net --recv-keys 4D781827 --5ixjydgjgwe2cenj Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQTXuabgHDW6LPt9CICxBBozTXgYJwUCWi5N8wAKCRCxBBozTXgY J+MlAJwLxwROZP87eJHvPrZbeRzGEU6pMgCffeC0j9BxU+t9vpnmsC9u6jyUzOs= =xy7E -----END PGP SIGNATURE----- --5ixjydgjgwe2cenj--