From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.4 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1C182C432BE for ; Wed, 4 Aug 2021 09:43:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DF9F660F58 for ; Wed, 4 Aug 2021 09:43:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237123AbhHDJoB (ORCPT ); Wed, 4 Aug 2021 05:44:01 -0400 Received: from mail.ispras.ru ([83.149.199.84]:47584 "EHLO mail.ispras.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236511AbhHDJoB (ORCPT ); Wed, 4 Aug 2021 05:44:01 -0400 Received: from hellwig.intra.ispras.ru (unknown [10.10.2.182]) by mail.ispras.ru (Postfix) with ESMTPSA id 2141940D403D; Wed, 4 Aug 2021 09:43:43 +0000 (UTC) Subject: Re: [PATCH] platform/x86: intel_pmc_core: Fix potential buffer overflows To: Andy Shevchenko Cc: Rajneesh Bhardwaj , David E Box , Hans de Goede , Mark Gross , "David E. Box" , Gayatri Kammela , Platform Driver , Linux Kernel Mailing List , ldv-project@linuxtesting.org References: <20210803181135.22298-1-novikov@ispras.ru> From: Evgeny Novikov Message-ID: <394f3b53-7896-c602-a6d2-e0e17d1e647e@ispras.ru> Date: Wed, 4 Aug 2021 12:43:43 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.12.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03.08.2021 21:30, Andy Shevchenko wrote: > On Tue, Aug 3, 2021 at 9:26 PM Andy Shevchenko > wrote: >> On Tue, Aug 3, 2021 at 9:21 PM Evgeny Novikov wrote: >>> It looks like pmc_core_get_low_power_modes() mixes up modes and >>> priorities. In addition to invalid behavior, potentially this can >>> cause buffer overflows since the driver reads priorities from the >>> register and then it uses them as indexes for array lpm_priority >>> that can contain 8 elements at most. The patch swaps modes and >>> priorities. >>> >>> Found by Linux Driver Verification project (linuxtesting.org). >> Seems legit. > Hold on, but then it follows with another loop where actually it reads > modes by priority index. Can you elaborate what exactly is the problem > you think? > I agree with you and David that my fix was not valid from the functional point of view. Indeed, some issues can happen if something unexpected will be read from the register. For instance, for priority equals to 255 you will have pri0 = 15 and prio1 = 15. Obviously, you can not access the lpm_priority array consisting of just 8 elements by these indexes. Best regards, Evgeny Novikov