linux-kernel - Re: [PATCH] gpu/drm/drm_framebuffer.c: Use Macro instead of actual number.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <40323b1b-b2de-45b2-88f2-d6b440e10f76@suse.de>
Date:   Thu, 2 Nov 2023 14:27:09 +0100
From:   Thomas Zimmermann <tzimmermann@...e.de>
To:     Peng Hao <penghao@...gdao.com>, maarten.lankhorst@...ux.intel.com,
        mripard@...nel.org, airlied@...il.com, daniel@...ll.ch
Cc:     linux-kernel@...r.kernel.org, dri-devel@...ts.freedesktop.org
Subject: Re: [PATCH] gpu/drm/drm_framebuffer.c: Use Macro instead of actual
 number.

Hi

Am 02.11.23 um 03:29 schrieb Peng Hao:
> Use Macro DRM_FORMAT_MAX_PLANES instead of 4, to improve modifiability.
> 
> Signed-off-by: Peng Hao <penghao@...gdao.com>
> ---
>   drivers/gpu/drm/drm_framebuffer.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
> index 2dd97473ca10..bf283dae9090 100644
> --- a/drivers/gpu/drm/drm_framebuffer.c
> +++ b/drivers/gpu/drm/drm_framebuffer.c
> @@ -254,7 +254,7 @@ static int framebuffer_check(struct drm_device *dev,
>   		}
>   	}
>   
> -	for (i = info->num_planes; i < 4; i++) {
> +	for (i = info->num_planes; i < DRM_FORMAT_MAX_PLANES; i++) {

This change makes the code more fragile. '4' is a fixed constant in the 
UAPI struct, while DRM_FORMAT_MAX_PLANES is an internal constant. I 
agree that both should reasonably have the same value. But (potentially) 
changing the value of DRM_FORMAT_MAX_PLANES will break these loops with 
a possible OOB access.

To make make this code more robust, it might be better to rewrite the 
tests like this

for (i = num_planes; i < ARRAY_SIZE(r->modifier); +i) {
	// the test for modifier[i]
}

if (r->flags & DRM_MODE_FB_MODIFIERS) {
  	for (i < ARRAY_SIZE(handles)) {
		// test for handles[i]
	}
  	for (i < ARRAY_SIZE(pitches)) {
		// test for pitches[i]
	}
  	for (i < ARRAY_SIZE(offsets)) {
		// test for offsets[i]
	}
}

Best regards
Thomas

>   		if (r->modifier[i]) {
>   			drm_dbg_kms(dev, "non-zero modifier for unused plane %d\n", i);
>   			return -EINVAL;

-- 
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (841 bytes)