renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-19 02:34:01 +08:00
Code

drm/atomic: fix out of bounds read in for_each_*_in_state helpers

Browse Source 
for_each_*_in_state validate array index after
access to array elements, thus perform out of bounds read.

Fix this by validating index in the first place and read
array element iff validation was successful.

Fixes: df63b9994e ("drm/atomic: Add for_each_{connector,crtc,plane}_in_state helper macros")
Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
This commit is contained in:
Andrey Ryabinin 2015-05-25 13:29:44 +03:00 committed by Daniel Vetter
parent 955f3c334f
commit 60f207a5b6
1 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
include/drm/drm_atomic.h
View File

@ -142,26 +142,26 @@ int __must_check drm_atomic_async_commit(struct drm_atomic_state *state);
#define for_each_connector_in_state(state, connector, connector_state, __i) \
for ((__i) = 0; \
(connector) = (state)->connectors[__i], \
(connector_state) = (state)->connector_states[__i], \
(__i) < (state)->num_connector; \
(__i) < (state)->num_connector && \
((connector) = (state)->connectors[__i], \
(connector_state) = (state)->connector_states[__i], 1); \
(__i)++) \
if (connector)
#define for_each_crtc_in_state(state, crtc, crtc_state, __i) \
for ((__i) = 0; \
(crtc) = (state)->crtcs[__i], \
(crtc_state) = (state)->crtc_states[__i], \
(__i) < (state)->dev->mode_config.num_crtc; \
(__i) < (state)->dev->mode_config.num_crtc && \
((crtc) = (state)->crtcs[__i], \
(crtc_state) = (state)->crtc_states[__i], 1); \
(__i)++) \
if (crtc_state)
#define for_each_plane_in_state(state, plane, plane_state, __i) \
for ((__i) = 0; \
(plane) = (state)->planes[__i], \
(plane_state) = (state)->plane_states[__i], \
(__i) < (state)->dev->mode_config.num_total_plane; \
(__i)++) \
#define for_each_plane_in_state(state, plane, plane_state, __i) \
for ((__i) = 0; \
(__i) < (state)->dev->mode_config.num_total_plane && \
((plane) = (state)->planes[__i], \
(plane_state) = (state)->plane_states[__i], 1); \
(__i)++) \
if (plane_state)
#endif /* DRM_ATOMIC_H_ */