Re: [PATCH][next] drm/kmb: fix array out-of-bounds writes to kmb->plane_status[]

; David Airlie ; Daniel Vetter >> ; dri-de...@lists.freedesktop.org; kernel- >> janit...@vger.kernel.org; linux-kernel@vger.kernel.org >> Subject: Re: [PATCH][next] drm/kmb: fix array out-of-bounds writes to kmb- >>> plane_status[] >> >> Hi Colin. >> On Fri, Nov 13, 2020

RE: [PATCH][next] drm/kmb: fix array out-of-bounds writes to kmb->plane_status[]

kernel.org; linux-kernel@vger.kernel.org > Subject: Re: [PATCH][next] drm/kmb: fix array out-of-bounds writes to kmb- > >plane_status[] > > Hi Colin. > On Fri, Nov 13, 2020 at 03:04:34PM +, Colin Ian King wrote: > > On 13/11/2020 14:55, Sam Ravnborg wrote: > > >

Re: [PATCH][next] drm/kmb: fix array out-of-bounds writes to kmb->plane_status[]

Hi Colin. On Fri, Nov 13, 2020 at 03:04:34PM +, Colin Ian King wrote: > On 13/11/2020 14:55, Sam Ravnborg wrote: > > Hi Colin. > > > > On Fri, Nov 13, 2020 at 12:01:21PM +, Colin King wrote: > >> From: Colin Ian King > >> > >> Writes to elements in the kmb->plane_status array in function

Re: [PATCH][next] drm/kmb: fix array out-of-bounds writes to kmb->plane_status[]

On 13/11/2020 14:55, Sam Ravnborg wrote: > Hi Colin. > > On Fri, Nov 13, 2020 at 12:01:21PM +, Colin King wrote: >> From: Colin Ian King >> >> Writes to elements in the kmb->plane_status array in function >> kmb_plane_atomic_disable are overrunning the array when plane_id is >> more than 1

Re: [PATCH][next] drm/kmb: fix array out-of-bounds writes to kmb->plane_status[]

Hi Colin. On Fri, Nov 13, 2020 at 12:01:21PM +, Colin King wrote: > From: Colin Ian King > > Writes to elements in the kmb->plane_status array in function > kmb_plane_atomic_disable are overrunning the array when plane_id is > more than 1 because currently the array is KMB_MAX_PLANES

[PATCH][next] drm/kmb: fix array out-of-bounds writes to kmb->plane_status[]

From: Colin Ian King Writes to elements in the kmb->plane_status array in function kmb_plane_atomic_disable are overrunning the array when plane_id is more than 1 because currently the array is KMB_MAX_PLANES elements in size and this is currently #defined as 1. Fix this by defining