Hi,
I was trying to track down an out of bounds read issue in the intel drm
driver that got reported by kasan.
It happens in the function validate_cmds_sorted (i915_cmd_parser.c),
where there are two nested loops, this is the relevant code part:
for (i = 0; i < cmd_table_count; i++) {
const struct drm_i915_cmd_table *table = &cmd_tables[i];
u32 previous = 0;
int j;
for (j = 0; j < table->count; j++) {
const struct drm_i915_cmd_descriptor *desc =
&table->table[i];
Now that &table->table[i] should probably really be &table->table[j],
because that's the counter variable of the inner loop. Otherwise it
doesn't make any sense (the inner loop would just repeat doing the same
thing multiple times).
However if I try to change [i] to [j] here my system doesn't boot any
more, I just get a black screen. So I assume this bug is somehow hiding
another more severe bug.
cu,
--
Hanno Böck
http://hboeck.de/
mail/jabber: hanno@xxxxxxxxx
GPG: BBB51E42
Attachment:
pgp634wr9mdrF.pgp
Description: OpenPGP digital signature
_______________________________________________ Intel-gfx mailing list Intel-gfx@xxxxxxxxxxxxxxxxxxxxx http://lists.freedesktop.org/mailman/listinfo/intel-gfx
