Commit 60f207a5 authored by Andrey Ryabinin's avatar Andrey Ryabinin Committed by Daniel Vetter
Browse files

drm/atomic: fix out of bounds read in for_each_*_in_state helpers 



for_each_*_in_state validate array index after
access to array elements, thus perform out of bounds read.

Fix this by validating index in the first place and read
array element iff validation was successful.

Fixes: df63b999 ("drm/atomic: Add for_each_{connector,crtc,plane}_in_state helper macros")
Signed-off-by: default avatarAndrey Ryabinin <a.ryabinin@samsung.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
parent 955f3c33

include/drm/drm_atomic.h

+12 −12
Original line number Diff line number Diff line
@@ -142,25 +142,25 @@ int __must_check drm_atomic_async_commit(struct drm_atomic_state *state); 


#define for_each_connector_in_state(state, connector, connector_state, __i) \

	for ((__i) = 0;							\

	     (connector) = (state)->connectors[__i],			\

	     (connector_state) = (state)->connector_states[__i],	\

	     (__i) < (state)->num_connector;				\

	     (__i) < (state)->num_connector &&				\

	     ((connector) = (state)->connectors[__i],			\

	     (connector_state) = (state)->connector_states[__i], 1); 	\

	     (__i)++)							\

		if (connector)



#define for_each_crtc_in_state(state, crtc, crtc_state, __i)	\

	for ((__i) = 0;						\

	     (crtc) = (state)->crtcs[__i],			\

	     (crtc_state) = (state)->crtc_states[__i],		\

	     (__i) < (state)->dev->mode_config.num_crtc;	\

	     (__i) < (state)->dev->mode_config.num_crtc &&	\

	     ((crtc) = (state)->crtcs[__i],			\

	     (crtc_state) = (state)->crtc_states[__i], 1);	\

	     (__i)++)						\

		if (crtc_state)



#define for_each_plane_in_state(state, plane, plane_state, __i)		\

	for ((__i) = 0;							\

	     (plane) = (state)->planes[__i],			\

	     (plane_state) = (state)->plane_states[__i],	\

	     (__i) < (state)->dev->mode_config.num_total_plane;	\

	     (__i) < (state)->dev->mode_config.num_total_plane &&	\

	     ((plane) = (state)->planes[__i],				\

	     (plane_state) = (state)->plane_states[__i], 1);		\

	     (__i)++)							\

		if (plane_state)

CRA Git | Maintained and supported by SUSTech CRA and CCSE