drm/atomic: fix out of bounds read in for_each_*_in_state helpers
authorAndrey Ryabinin <a.ryabinin@samsung.com>
Mon, 25 May 2015 10:29:44 +0000 (13:29 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 3 Aug 2015 16:29:08 +0000 (09:29 -0700)
commitc074d39c847fa25c63bff1361ac0518ccd1f2fef
tree4c278cba5f31d6a2bfc437a22ab6b91f1e9cb832
parentdb4d9159da3f595b964d986cb53d33fd24e5774c
drm/atomic: fix out of bounds read in for_each_*_in_state helpers

commit 60f207a5b6d8f23c2e8388b415e8d5c7311cc79d upstream.

for_each_*_in_state validate array index after
access to array elements, thus perform out of bounds read.

Fix this by validating index in the first place and read
array element iff validation was successful.

Fixes: df63b9994eaf ("drm/atomic: Add for_each_{connector,crtc,plane}_in_state helper macros")
Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
include/drm/drm_atomic.h