[Intel-gfx] Error in inner loop in validate_cmds_sorted / out of bounds issue

[Hanno Böck]

Hi,

I was trying to track down an out of bounds read issue in the intel drm
driver that got reported by kasan.

It happens in the function validate_cmds_sorted (i915_cmd_parser.c),
where there are two nested loops, this is the relevant code part:
	for (i = 0; i < cmd_table_count; i++) {
		const struct drm_i915_cmd_table *table = &cmd_tables[i];
		u32 previous = 0;
		int j;

		for (j = 0; j < table->count; j++) {
			const struct drm_i915_cmd_descriptor *desc =
				&table->table[i];


Now that &table->table[i] should probably really be &table->table[j],
because that's the counter variable of the inner loop. Otherwise it
doesn't make any sense (the inner loop would just repeat doing the same
thing multiple times).
However if I try to change [i] to [j] here my system doesn't boot any
more, I just get a black screen. So I assume this bug is somehow hiding
another more severe bug.


cu,
-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno at hboeck.de
GPG: BBB51E42
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freedesktop.org/archives/intel-gfx/attachments/20150725/8981015b/attachment.sig>