From: Alexey Khoroshilov <khoroshilov@ispras.ru>
To: Andrey Shumilin <shum.sdl@nppct.ru>, Karol Herbst <kherbst@redhat.com>
Cc: "lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>,
nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org,
dri-devel@lists.freedesktop.org, Daniel Vetter <daniel@ffwll.ch>
Subject: Re: [PATCH] therm.c: Adding an array index check before accessing an element.
Date: Fri, 5 Jan 2024 20:50:34 +0700 [thread overview]
Message-ID: <5be85b32-7339-d306-897e-142332807c9b@ispras.ru> (raw)
In-Reply-To: <20231116063028.35871-1-shum.sdl@nppct.ru>
> Subject: therm.c: Adding an array index check before accessing an element.
As
$ git log --oneline drivers/gpu/drm/nouveau/nvkm/subdev/bios/therm.c
a215721fb64e drm/nouveau/bios/therm: pointers are 32-bit
46484438ab7d drm/nouveau/bios: convert to new-style nvkm_subdev
7f5f518fd70b drm/nouveau/bios: remove object accessor functions
60b29d207179 drm/nouveau/bios: switch to subdev printk macros
9ace404b1098 drm/nouveau/device: include core/device.h automatically for
subdevs/engines
d390b48027f8 drm/nouveau/bios: namespace + nvidia gpu names (no binary
change)
c39f472e9f14 drm/nouveau: remove symlinks, move core/ to nvkm/ (no code
changes)
shows, a better prefix should be
drm/nouveau/bios: or drm/nouveau/bios/therm:
and there should not be a dot at the end.
e.g.
drm/nouveau/bios: avoid invalid memory memory access in
nvbios_therm_fan_parse()
On 16.11.2023 09:30, Andrey Shumilin wrote:
> It is possible to access an element at index -1 if at the first iteration of the loop the result of switch is equal to 0x25
>
If nvbios_rd08(bios, entry + 0) returns 0x25 before 0x24, buffer
underrun happens as far as &fan->trip[fan->nr_fan_trip - 1] points to
invalid memory.
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Andrey Shumilin <shum.sdl@nppct.ru>
> ---
> drivers/gpu/drm/nouveau/nvkm/subdev/bios/therm.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/therm.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/therm.c
> index 5babc5a7c7d5..78387053f214 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/therm.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/therm.c
> @@ -180,6 +180,8 @@ nvbios_therm_fan_parse(struct nvkm_bios *bios, struct nvbios_therm_fan *fan)
> cur_trip->fan_duty = duty_lut[(value & 0xf000) >> 12];
> break;
> case 0x25:
> + if (fan->nr_fan_trip == 0)
> + fan->nr_fan_trip++;
I would suggest to return -EINVAL if the assumption on valid nr_fan_trip
is failed.
> cur_trip = &fan->trip[fan->nr_fan_trip - 1];
> cur_trip->fan_duty = value;
> break;
>
--
Alexey
next prev parent reply other threads:[~2024-01-16 11:50 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-16 6:30 [PATCH] therm.c: Adding an array index check before accessing an element Andrey Shumilin
2024-01-05 13:50 ` Alexey Khoroshilov [this message]
-- strict thread matches above, loose matches on Subject: below --
2024-03-23 6:39 Andrey Shumilin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5be85b32-7339-d306-897e-142332807c9b@ispras.ru \
--to=khoroshilov@ispras.ru \
--cc=daniel@ffwll.ch \
--cc=dri-devel@lists.freedesktop.org \
--cc=kherbst@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lvc-project@linuxtesting.org \
--cc=nouveau@lists.freedesktop.org \
--cc=shum.sdl@nppct.ru \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).