[PATCH] drm/xe: Fix global-out-of-bounds in rule_matches

[Lucas De Marchi]

On Mon, Jul 01, 2024 at 05:37:02PM GMT, Nirmoy Das wrote:
>Do post-increment instead of pre-increment to fix:
>[ 9344.404516] BUG: KASAN: global-out-of-bounds in rule_matches+0xb72/0x11c0 [xe]
>[ 9344.411887] Read of size 1 at addr ffffffffa330b210 by task xe_module_load/248463
>
>Fixes: dc72c52a42e0 ("drm/xe/rtp: Allow to OR rules")
>Cc: Lucas De Marchi <lucas.demarchi at intel.com>
>Signed-off-by: Nirmoy Das <nirmoy.das at intel.com>
>---
> drivers/gpu/drm/xe/xe_rtp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/gpu/drm/xe/xe_rtp.c b/drivers/gpu/drm/xe/xe_rtp.c
>index 5b27f7c45ea3..f6ec8df5fc94 100644
>--- a/drivers/gpu/drm/xe/xe_rtp.c
>+++ b/drivers/gpu/drm/xe/xe_rtp.c
>@@ -121,7 +121,7 @@ static bool rule_matches(const struct xe_device *xe,
> 			 * Advance rules until we find XE_RTP_MATCH_OR to check
> 			 * if there's another set of conditions to check
> 			 */
>-			while (i < n_rules && rules[++i].match_type != XE_RTP_MATCH_OR)
>+			while (i < n_rules && rules[i++].match_type != XE_RTP_MATCH_OR)

this will double check the current iteration. A better fix was posted last
week and I will merge it soon:

https://patchwork.freedesktop.org/series/135527/

Lucas De Marchi

> 				;
>
> 			if (i >= n_rules)
>-- 
>2.42.0
>