linux-kernel - Re: [PATCH][next] drm/kmb: fix array out-of-bounds writes to kmb->plane

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 13 Nov 2020 15:04:34 +0000
From:   Colin Ian King <colin.king@...onical.com>
To:     Sam Ravnborg <sam@...nborg.org>
Cc:     Anitha Chrisanthus <anitha.chrisanthus@...el.com>,
        Edmund Dea <edmund.j.dea@...el.com>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        dri-devel@...ts.freedesktop.org, kernel-janitors@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH][next] drm/kmb: fix array out-of-bounds writes to
 kmb->plane_status[]

On 13/11/2020 14:55, Sam Ravnborg wrote:
> Hi Colin.
> 
> On Fri, Nov 13, 2020 at 12:01:21PM +0000, Colin King wrote:
>> From: Colin Ian King <colin.king@...onical.com>
>>
>> Writes to elements in the kmb->plane_status array in function
>> kmb_plane_atomic_disable are overrunning the array when plane_id is
>> more than 1 because currently the array is KMB_MAX_PLANES elements
>> in size and this is currently #defined as 1.  Fix this by defining
>> KMB_MAX_PLANES to 4.
> 
> I fail to follow you here.
> In kmb_plane_init() only one plane is allocated - with id set to 0.
> So for now only one plane is allocated thus kmb_plane_atomic_disable()
> is only called for this plane.
> 
> With your change we will start allocating four planes, something that is
> not tested.
> 
> Do I miss something?
> 
> 	Sam
> 

The static analysis from coverity on linux-next suggested that there was
an array overflow as follows:

108 static void kmb_plane_atomic_disable(struct drm_plane *plane,
109                                     struct drm_plane_state *state)
110 {

   1. Condition 0 /* !!(!__builtin_types_compatible_p() &&
!__builtin_types_compatible_p()) */, taking false branch.

111        struct kmb_plane *kmb_plane = to_kmb_plane(plane);

   2. assignment: Assigning: plane_id = kmb_plane->id.

112        int plane_id = kmb_plane->id;
113        struct kmb_drm_private *kmb;
114
115        kmb = to_kmb(plane->dev);
116

   3. Switch case value LAYER_3.

117        switch (plane_id) {
118        case LAYER_0:
119                kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL1_ENABLE;
120                break;
121        case LAYER_1:

   (#2 of 4): Out-of-bounds write (OVERRUN)

122                kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL2_ENABLE;
123                break;
124        case LAYER_2:

   (#3 of 4): Out-of-bounds write (OVERRUN)

125                kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL1_ENABLE;
126                break;

   4. equality_cond: Jumping to case LAYER_3.

127        case LAYER_3:

   (#1 of 4): Out-of-bounds write (OVERRUN)
   5. overrun-local: Overrunning array kmb->plane_status of 1 8-byte
elements at element index 3 (byte offset 31) using index plane_id (which
evaluates to 3).

128                kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL2_ENABLE;
129                break;
130        }
131

   (#4 of 4): Out-of-bounds write (OVERRUN)

132        kmb->plane_status[plane_id].disable = true;
133 }
134

So it seems the assignments to  kmb->plane_status[plane_id] are
overrunning the array since plane_status is allocated as 1 element and
yet plane_id can be 0..3

I could be misunderstanding this, or it may be a false positive.

Colin