From: Andy Shevchenko <andy.shevchenko@gmail.com>
To: Evgeny Novikov <novikov@ispras.ru>
Cc: Rajneesh Bhardwaj <irenic.rajneesh@gmail.com>,
David E Box <david.e.box@intel.com>,
Hans de Goede <hdegoede@redhat.com>,
Mark Gross <mgross@linux.intel.com>,
"David E. Box" <david.e.box@linux.intel.com>,
Gayatri Kammela <gayatri.kammela@intel.com>,
Platform Driver <platform-driver-x86@vger.kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
ldv-project@linuxtesting.org
Subject: Re: [PATCH] platform/x86: intel_pmc_core: Fix potential buffer overflows
Date: Tue, 3 Aug 2021 21:30:17 +0300 [thread overview]
Message-ID: <CAHp75VfVCk1ueQZiGnJqwhD=j+zpVZ3Q-GmLMKX9AfP_BFMPNA@mail.gmail.com> (raw)
In-Reply-To: <CAHp75Vde1RAKTCTzmt0eHjNGrKUyi7r1rtNo934WW6wqi9T=ng@mail.gmail.com>
On Tue, Aug 3, 2021 at 9:26 PM Andy Shevchenko
<andy.shevchenko@gmail.com> wrote:
> On Tue, Aug 3, 2021 at 9:21 PM Evgeny Novikov <novikov@ispras.ru> wrote:
> >
> > It looks like pmc_core_get_low_power_modes() mixes up modes and
> > priorities. In addition to invalid behavior, potentially this can
> > cause buffer overflows since the driver reads priorities from the
> > register and then it uses them as indexes for array lpm_priority
> > that can contain 8 elements at most. The patch swaps modes and
> > priorities.
> >
> > Found by Linux Driver Verification project (linuxtesting.org).
>
> Seems legit.
Hold on, but then it follows with another loop where actually it reads
modes by priority index. Can you elaborate what exactly is the problem
you think?
--
With Best Regards,
Andy Shevchenko
next prev parent reply other threads:[~2021-08-03 18:31 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-03 18:11 [PATCH] platform/x86: intel_pmc_core: Fix potential buffer overflows Evgeny Novikov
2021-08-03 18:26 ` Andy Shevchenko
2021-08-03 18:30 ` Andy Shevchenko [this message]
2021-08-04 9:43 ` Evgeny Novikov
2021-08-03 21:49 ` David E. Box
2021-08-04 0:30 ` [PATCH] platform/x86: intel_pmc_core: Prevent possibile overflow David E. Box
2021-08-04 10:48 ` Evgeny Novikov
2021-08-04 21:51 ` David E. Box
2021-08-05 16:21 ` Evgeny Novikov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHp75VfVCk1ueQZiGnJqwhD=j+zpVZ3Q-GmLMKX9AfP_BFMPNA@mail.gmail.com' \
--to=andy.shevchenko@gmail.com \
--cc=david.e.box@intel.com \
--cc=david.e.box@linux.intel.com \
--cc=gayatri.kammela@intel.com \
--cc=hdegoede@redhat.com \
--cc=irenic.rajneesh@gmail.com \
--cc=ldv-project@linuxtesting.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mgross@linux.intel.com \
--cc=novikov@ispras.ru \
--cc=platform-driver-x86@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).