linux-kernel - Re: [PATCH AUTOSEL 5.10 8/8] fbdev: omapfb: Add 'plane' value check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aAKGvh0fdMZPT9Jd@duo.ucw.cz>
Date: Fri, 18 Apr 2025 19:07:10 +0200
From: Pavel Machek <pavel@...x.de>
To: Sasha Levin <sashal@...nel.org>
Cc: linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	Leonid Arapov <arapovl839@...il.com>, Helge Deller <deller@....de>,
	krzysztof.kozlowski@...aro.org, u.kleine-koenig@...libre.com,
	linux@...blig.org, linux-omap@...r.kernel.org,
	linux-fbdev@...r.kernel.org, dri-devel@...ts.freedesktop.org
Subject: Re: [PATCH AUTOSEL 5.10 8/8] fbdev: omapfb: Add 'plane' value check

Hi!

> Function dispc_ovl_setup is not intended to work with the value OMAP_DSS_WB
> of the enum parameter plane.
> 
> The value of this parameter is initialized in dss_init_overlays and in the
> current state of the code it cannot take this value so it's not a real
> problem.
> 
> For the purposes of defensive coding it wouldn't be superfluous to check
> the parameter value, because some functions down the call stack process
> this value correctly and some not.
> 
> For example, in dispc_ovl_setup_global_alpha it may lead to buffer
> overflow.
> 
> Add check for this value.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE static
> analysis tool.

As changelog explains, this is robustness, not really a bug fix. We
should not need it in -stable. (Or maybe rules file should be updated,
because noone seems to be following this rule).

Best regards,
								Pavel
								
> +++ b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c
> @@ -2751,9 +2751,13 @@ int dispc_ovl_setup(enum omap_plane plane, const struct omap_overlay_info *oi,
>  		bool mem_to_mem)
>  {
>  	int r;
> -	enum omap_overlay_caps caps = dss_feat_get_overlay_caps(plane);
> +	enum omap_overlay_caps caps;
>  	enum omap_channel channel;
>  
> +	if (plane == OMAP_DSS_WB)
> +		return -EINVAL;
> +
> +	caps = dss_feat_get_overlay_caps(plane);
>  	channel = dispc_ovl_get_channel_out(plane);
>  
>  	DSSDBG("dispc_ovl_setup %d, pa %pad, pa_uv %pad, sw %d, %d,%d, %dx%d ->"

-- 
DENX Software Engineering GmbH,        Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)