Messages in this thread | | | Subject | Re: [PATCH][next] drm/kmb: fix array out-of-bounds writes to kmb->plane_status[] | From | Colin Ian King <> | Date | Fri, 13 Nov 2020 15:04:34 +0000 |
| |
On 13/11/2020 14:55, Sam Ravnborg wrote: > Hi Colin. > > On Fri, Nov 13, 2020 at 12:01:21PM +0000, Colin King wrote: >> From: Colin Ian King <colin.king@canonical.com> >> >> Writes to elements in the kmb->plane_status array in function >> kmb_plane_atomic_disable are overrunning the array when plane_id is >> more than 1 because currently the array is KMB_MAX_PLANES elements >> in size and this is currently #defined as 1. Fix this by defining >> KMB_MAX_PLANES to 4. > > I fail to follow you here. > In kmb_plane_init() only one plane is allocated - with id set to 0. > So for now only one plane is allocated thus kmb_plane_atomic_disable() > is only called for this plane. > > With your change we will start allocating four planes, something that is > not tested. > > Do I miss something? > > Sam >
The static analysis from coverity on linux-next suggested that there was an array overflow as follows:
108 static void kmb_plane_atomic_disable(struct drm_plane *plane, 109 struct drm_plane_state *state) 110 {
1. Condition 0 /* !!(!__builtin_types_compatible_p() && !__builtin_types_compatible_p()) */, taking false branch.
111 struct kmb_plane *kmb_plane = to_kmb_plane(plane);
2. assignment: Assigning: plane_id = kmb_plane->id.
112 int plane_id = kmb_plane->id; 113 struct kmb_drm_private *kmb; 114 115 kmb = to_kmb(plane->dev); 116
3. Switch case value LAYER_3.
117 switch (plane_id) { 118 case LAYER_0: 119 kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL1_ENABLE; 120 break; 121 case LAYER_1:
(#2 of 4): Out-of-bounds write (OVERRUN)
122 kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL2_ENABLE; 123 break; 124 case LAYER_2:
(#3 of 4): Out-of-bounds write (OVERRUN)
125 kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL1_ENABLE; 126 break;
4. equality_cond: Jumping to case LAYER_3.
127 case LAYER_3:
(#1 of 4): Out-of-bounds write (OVERRUN) 5. overrun-local: Overrunning array kmb->plane_status of 1 8-byte elements at element index 3 (byte offset 31) using index plane_id (which evaluates to 3).
128 kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL2_ENABLE; 129 break; 130 } 131
(#4 of 4): Out-of-bounds write (OVERRUN)
132 kmb->plane_status[plane_id].disable = true; 133 } 134
So it seems the assignments to kmb->plane_status[plane_id] are overrunning the array since plane_status is allocated as 1 element and yet plane_id can be 0..3
I could be misunderstanding this, or it may be a false positive.
Colin
| |