Skip to contentSkip to conversation

debugfs: Fix writing an extra zero out of bounds in igt_crc_to_string_extended()

PATCH In review Maarten Lankhorst 3 participants 7 messages Jan 28, 2019 – Feb 1, 2019 Library code

lore
Share & tools
lore

Maarten Lankhorst

author
#0 lore raw

PATCH 1/1 debugfs: Fix writing an extra zero out of bounds in igt_crc_to_string_extended()

Signed-off-by Maarten Lankhorst <[email protected]>
---
 lib/igt_debugfs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
lib/igt_debugfs.c +4 -4
index 3656c66a5674..d1fc0ff7f710 100644
@@ -458,17 +458,17 @@ char *igt_crc_to_string_extended(igt_crc_t *crc, char delimiter, int crc_size)
 	int i;
 	int len = 0;
 	int field_width = 2 * crc_size; /* Two chars per byte. */
-	char *buf = malloc((field_width+1) * crc->n_words * sizeof(char));
+	char *buf = malloc((field_width+1) * crc->n_words);
 
 	if (!buf)
 		return NULL;
 
-	for (i = 0; i < crc->n_words; i++)
+	for (i = 0; i < crc->n_words - 1; i++)
 		len += sprintf(buf + len, "%0*x%c", field_width,
 			       crc->crc[i], delimiter);
 
-	/* Eat the last delimiter */
-	buf[len - 1] = '\0';
+	sprintf(buf + len, "%0*x", field_width, crc->crc[i]);
+
 	return buf;
 }
Signature · 6 lines
2.20.1

_______________________________________________
igt-dev mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/igt-dev
#1 lore raw
Quoted 13 lines · Maarten Lankhorst
Signed-off-by Maarten Lankhorst <[email protected]>
---
 lib/igt_debugfs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
lib/igt_debugfs.c +0 -0
index 3656c66a5674..d1fc0ff7f710 100644
@@ -458,17 +458,17 @@ char *igt_crc_to_string_extended(igt_crc_t *crc, char delimiter, int crc_size)
 	int i;
 	int len = 0;
 	int field_width = 2 * crc_size; /* Two chars per byte. */

lib/igt_debugfs.c char *igt_crc_to_string_extended(igt_crc_t *crc, char delimiter, int crc_size) · line 468

Quoted 10 lines
lib/igt_debugfs.c +2 -2
-	char *buf = malloc((field_width+1) * crc->n_words * sizeof(char));
+	char *buf = malloc((field_width+1) * crc->n_words);
 
 	if (!buf)
 		return NULL;
 
-	for (i = 0; i < crc->n_words; i++)
+	for (i = 0; i < crc->n_words - 1; i++)
 		len += sprintf(buf + len, "%0*x%c", field_width,
 			       crc->crc[i], delimiter);

Or keep the loop condition and make this:

		len += sprintf(buf + len, "%s%0*x", i ? &delimiter : "",
			       field_width, crc->crc[i]);

Additionally could make the delimiter passed here a char*.

BR,
Jani.

Quoted 7 lines
lib/igt_debugfs.c +2 -2
-	/* Eat the last delimiter */
-	buf[len - 1] = '\0';
+	sprintf(buf + len, "%0*x", field_width, crc->crc[i]);
+
 	return buf;
 }
Signature · 5 lines
Jani Nikula, Intel Open Source Graphics Center
_______________________________________________
igt-dev mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/igt-dev
author
#2 lore raw

Op 28-01-2019 om 13:24 schreef Jani Nikula:

Quoted 26 lines · Maarten Lankhorst
Quoted 13 lines
Signed-off-by Maarten Lankhorst <[email protected]>
---
 lib/igt_debugfs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
lib/igt_debugfs.c +0 -0
index 3656c66a5674..d1fc0ff7f710 100644
@@ -458,17 +458,17 @@ char *igt_crc_to_string_extended(igt_crc_t *crc, char delimiter, int crc_size)
 	int i;
 	int len = 0;
 	int field_width = 2 * crc_size; /* Two chars per byte. */

lib/igt_debugfs.c char *igt_crc_to_string_extended(igt_crc_t *crc, char delimiter, int crc_size) · line 468

Quoted 10 lines
lib/igt_debugfs.c +2 -2
-	char *buf = malloc((field_width+1) * crc->n_words * sizeof(char));
+	char *buf = malloc((field_width+1) * crc->n_words);
 
 	if (!buf)
 		return NULL;
 
-	for (i = 0; i < crc->n_words; i++)
+	for (i = 0; i < crc->n_words - 1; i++)
 		len += sprintf(buf + len, "%0*x%c", field_width,
 			       crc->crc[i], delimiter);

Or keep the loop condition and make this:

Quoted 4 lines
		len += sprintf(buf + len, "%s%0*x", i ? &delimiter : "",
			       field_width, crc->crc[i]);

Additionally could make the delimiter passed here a char*.

That is also a valid solution. :) Is it ok to go with the solution I proposed or do you have a strong preference for that?

I don't think we can just pass &delimiter, we would depend on the next byte in memory accidentally being \0.

~Maarten

_______________________________________________
igt-dev mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/igt-dev

Reviewed-by
#3 lore raw
Quoted 30 lines · Maarten Lankhorst

Op 28-01-2019 om 13:24 schreef Jani Nikula:

Quoted 29 lines · Maarten Lankhorst
Quoted 13 lines
Signed-off-by Maarten Lankhorst <[email protected]>
---
 lib/igt_debugfs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
lib/igt_debugfs.c +0 -0
index 3656c66a5674..d1fc0ff7f710 100644
@@ -458,17 +458,17 @@ char *igt_crc_to_string_extended(igt_crc_t *crc, char delimiter, int crc_size)
 	int i;
 	int len = 0;
 	int field_width = 2 * crc_size; /* Two chars per byte. */

lib/igt_debugfs.c char *igt_crc_to_string_extended(igt_crc_t *crc, char delimiter, int crc_size) · line 468

Quoted 10 lines
lib/igt_debugfs.c +2 -2
-	char *buf = malloc((field_width+1) * crc->n_words * sizeof(char));
+	char *buf = malloc((field_width+1) * crc->n_words);
 
 	if (!buf)
 		return NULL;
 
-	for (i = 0; i < crc->n_words; i++)
+	for (i = 0; i < crc->n_words - 1; i++)
 		len += sprintf(buf + len, "%0*x%c", field_width,
 			       crc->crc[i], delimiter);

Or keep the loop condition and make this:

		len += sprintf(buf + len, "%s%0*x", i ? &delimiter : "",
			       field_width, crc->crc[i]);
Quoted 7 lines
Quoted 1 line

Additionally could make the delimiter passed here a char*.

That is also a valid solution. :) Is it ok to go with the solution I proposed or do you have a strong preference for that?

I don't think we can just pass &delimiter, we would depend on the next byte in memory accidentally being \0.

D'oh. Yeah, you'd have to pass the delimiter as a string to make this really work, or add a local buf. Meh. Something for the future.

On the original patch,

Reviewed-by Jani Nikula <[email protected]>
Signature · 5 lines
Jani Nikula, Intel Open Source Graphics Center
_______________________________________________
igt-dev mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/igt-dev
author
#4 lore raw

Op 01-02-2019 om 10:38 schreef Jani Nikula:

Quoted 35 lines · Maarten Lankhorst
Quoted 34 lines

Op 28-01-2019 om 13:24 schreef Jani Nikula:

Quoted 26 lines · Maarten Lankhorst
Quoted 13 lines
Signed-off-by Maarten Lankhorst <[email protected]>
---
 lib/igt_debugfs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
lib/igt_debugfs.c +0 -0
index 3656c66a5674..d1fc0ff7f710 100644
@@ -458,17 +458,17 @@ char *igt_crc_to_string_extended(igt_crc_t *crc, char delimiter, int crc_size)
 	int i;
 	int len = 0;
 	int field_width = 2 * crc_size; /* Two chars per byte. */

lib/igt_debugfs.c char *igt_crc_to_string_extended(igt_crc_t *crc, char delimiter, int crc_size) · line 468

Quoted 10 lines
lib/igt_debugfs.c +2 -2
-	char *buf = malloc((field_width+1) * crc->n_words * sizeof(char));
+	char *buf = malloc((field_width+1) * crc->n_words);
 
 	if (!buf)
 		return NULL;
 
-	for (i = 0; i < crc->n_words; i++)
+	for (i = 0; i < crc->n_words - 1; i++)
 		len += sprintf(buf + len, "%0*x%c", field_width,
 			       crc->crc[i], delimiter);

Or keep the loop condition and make this:

Quoted 4 lines
		len += sprintf(buf + len, "%s%0*x", i ? &delimiter : "",
			       field_width, crc->crc[i]);

Additionally could make the delimiter passed here a char*.

That is also a valid solution. :) Is it ok to go with the solution I proposed or do you have a strong preference for that?

Quoted 12 lines
Quoted 2 lines

I don't think we can just pass &delimiter, we would depend on the next byte in memory accidentally being \0.

D'oh. Yeah, you'd have to pass the delimiter as a string to make this really work, or add a local buf. Meh. Something for the future.

On the original patch,

Reviewed-by Jani Nikula <[email protected]>

Thanks, pushed. :)

_______________________________________________
igt-dev mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/igt-dev

CI
#5 lore raw

[igt-dev] ✓ Fi.CI.BAT: success for debugfs: Fix writing an extra zero out of bounds in igt_crc_to_string_extended()

In reply to Maarten Lankhorst
== Series Details ==

== Series Details ==

Series: debugfs: Fix writing an extra zero out of bounds in igt_crc_to_string_extended()
URL : https://patchwork.freedesktop.org/series/55832/
State : success

== Summary ==

CI Bug Log - changes from IGT_4794 -> IGTPW_2305
====================================================

Summary
-------

**SUCCESS**

No regressions found.

External URL: https://patchwork.freedesktop.org/api/1.0/series/55832/revisions/1/mbox/

Known issues
------------

Here are the changes found in IGTPW_2305 that come from known issues:

### IGT changes ###

#### Issues hit ####

* igt@kms_pipe_crc_basic@suspend-read-crc-pipe-b:
- fi-byt-clapper: PASS -> INCOMPLETE [fdo#102657]
- fi-blb-e6850: PASS -> INCOMPLETE [fdo#107718]

#### Possible fixes ####

* igt@pm_rpm@basic-pci-d3-state:
- fi-byt-n2820: {SKIP} [fdo#109271] -> PASS

* igt@pm_rpm@basic-rte:
- fi-byt-n2820: FAIL [fdo#108800] -> PASS

[fdo#102657]: https://bugs.freedesktop.org/show_bug.cgi?id=102657
[fdo#107718]: https://bugs.freedesktop.org/show_bug.cgi?id=107718
[fdo#108800]: https://bugs.freedesktop.org/show_bug.cgi?id=108800
[fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271

Participating hosts (45 -> 40)
------------------------------

Missing (5): fi-kbl-soraka fi-ilk-m540 fi-byt-squawks fi-bsw-cyan fi-icl-y

Build changes
-------------

* IGT: IGT_4794 -> IGTPW_2305

CI_DRM_5492: bc2fcdf82a5b94f015126dfa9db03f88feb9ae17 @ git://anongit.freedesktop.org/gfx-ci/linux
IGTPW_2305: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_2305/
IGT_4794: 4a94878797999d1d2f7d224c6cf2e2855cd3109a @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools

== Logs ==

For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_2305/
_______________________________________________
igt-dev mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/igt-dev

CI
#6 lore raw

[igt-dev] ✓ Fi.CI.IGT: success for debugfs: Fix writing an extra zero out of bounds in igt_crc_to_string_extended()

In reply to Maarten Lankhorst
== Series Details ==

== Series Details ==

Series: debugfs: Fix writing an extra zero out of bounds in igt_crc_to_string_extended()
URL : https://patchwork.freedesktop.org/series/55832/
State : success

== Summary ==

CI Bug Log - changes from IGT_4794_full -> IGTPW_2305_full
====================================================

Summary
-------

**SUCCESS**

No regressions found.

External URL: https://patchwork.freedesktop.org/api/1.0/series/55832/revisions/1/mbox/

Known issues
------------

Here are the changes found in IGTPW_2305_full that come from known issues:

### IGT changes ###

#### Issues hit ####

* igt@gem_eio@reset-stress:
- shard-snb: PASS -> INCOMPLETE [fdo#105411]

* igt@kms_available_modes_crc@available_mode_test_crc:
- shard-kbl: PASS -> FAIL [fdo#106641]

* igt@kms_busy@extended-modeset-hang-newfb-render-c:
- shard-glk: NOTRUN -> DMESG-WARN [fdo#107956] +1

* igt@kms_busy@extended-pageflip-hang-newfb-render-c:
- shard-apl: NOTRUN -> DMESG-WARN [fdo#107956]

* igt@kms_busy@extended-pageflip-modeset-hang-oldfb-render-b:
- shard-kbl: NOTRUN -> DMESG-WARN [fdo#107956]

* igt@kms_ccs@pipe-b-crc-sprite-planes-basic:
- shard-glk: PASS -> FAIL [fdo#108145]

* igt@kms_color@pipe-c-ctm-max:
- shard-kbl: NOTRUN -> FAIL [fdo#108147]
- shard-apl: NOTRUN -> FAIL [fdo#108147]

* igt@kms_color@pipe-c-degamma:
- shard-kbl: NOTRUN -> FAIL [fdo#104782]
- shard-apl: PASS -> FAIL [fdo#104782]

* igt@kms_content_protection@legacy:
- shard-kbl: NOTRUN -> FAIL [fdo#108597]

* igt@kms_cursor_crc@cursor-128x128-onscreen:
- shard-kbl: NOTRUN -> FAIL [fdo#103232]

* igt@kms_cursor_crc@cursor-128x128-suspend:
- shard-apl: PASS -> FAIL [fdo#103191] / [fdo#103232]

* igt@kms_cursor_crc@cursor-256x85-onscreen:
- shard-apl: NOTRUN -> FAIL [fdo#103232] +1

* igt@kms_cursor_crc@cursor-256x85-sliding:

    - shard-kbl:          PASS -> FAIL [fdo#103232] +3
    - shard-apl:          PASS -> FAIL [fdo#103232] +3
    - shard-glk:          PASS -> FAIL [fdo#103232]

* igt@kms_cursor_crc@cursor-64x64-suspend:
- shard-kbl: PASS -> FAIL [fdo#103191] / [fdo#103232]

* igt@kms_flip@flip-vs-expired-vblank:
- shard-glk: PASS -> FAIL [fdo#102887] / [fdo#105363]

* igt@kms_flip@flip-vs-modeset-interruptible:
- shard-hsw: PASS -> DMESG-WARN [fdo#102614]

* igt@kms_plane@plane-panning-bottom-right-suspend-pipe-c-planes:
- shard-kbl: PASS -> INCOMPLETE [fdo#103665] +1

* igt@kms_plane@plane-position-covered-pipe-b-planes:
- shard-glk: PASS -> FAIL [fdo#103166]

* igt@kms_plane_alpha_blend@pipe-a-alpha-opaque-fb:
- shard-kbl: NOTRUN -> FAIL [fdo#108145]

* igt@kms_plane_alpha_blend@pipe-b-alpha-basic:
- shard-glk: NOTRUN -> FAIL [fdo#108145]

* igt@kms_plane_multiple@atomic-pipe-c-tiling-yf:
- shard-kbl: PASS -> FAIL [fdo#103166]
- shard-glk: NOTRUN -> FAIL [fdo#103166]

* igt@kms_sysfs_edid_timing:
- shard-kbl: NOTRUN -> FAIL [fdo#100047]

#### Possible fixes ####

* igt@kms_cursor_crc@cursor-256x256-suspend:
- shard-apl: FAIL [fdo#103191] / [fdo#103232] -> PASS

* igt@kms_cursor_crc@cursor-64x21-sliding:
- shard-apl: FAIL [fdo#103232] -> PASS +6
- shard-kbl: FAIL [fdo#103232] -> PASS

* igt@kms_cursor_crc@cursor-64x64-sliding:
- shard-glk: FAIL [fdo#103232] -> PASS

* igt@kms_cursor_crc@cursor-size-change:
- shard-hsw: DMESG-FAIL [fdo#102614] / [fdo#103232] -> PASS

* igt@kms_plane_alpha_blend@pipe-c-constant-alpha-max:
- shard-glk: FAIL [fdo#108145] -> PASS +1

* igt@kms_plane_multiple@atomic-pipe-a-tiling-x:
- shard-apl: FAIL [fdo#103166] -> PASS +3

* igt@kms_plane_multiple@atomic-pipe-a-tiling-yf:
- shard-kbl: FAIL [fdo#103166] -> PASS

* igt@kms_plane_multiple@atomic-pipe-c-tiling-none:
- shard-glk: FAIL [fdo#103166] -> PASS +5

* igt@pm_rc6_residency@rc6-accuracy:
- shard-snb: {SKIP} [fdo#109271] -> PASS

* igt@prime_busy@hang-vebox:
- shard-hsw: FAIL [fdo#108807] -> PASS

{name}: This element is suppressed. This means it is ignored when computing
the status of the difference (SUCCESS, WARNING, or FAILURE).

[fdo#100047]: https://bugs.freedesktop.org/show_bug.cgi?id=100047
[fdo#102614]: https://bugs.freedesktop.org/show_bug.cgi?id=102614
[fdo#102887]: https://bugs.freedesktop.org/show_bug.cgi?id=102887
[fdo#103166]: https://bugs.freedesktop.org/show_bug.cgi?id=103166
[fdo#103191]: https://bugs.freedesktop.org/show_bug.cgi?id=103191
[fdo#103232]: https://bugs.freedesktop.org/show_bug.cgi?id=103232
[fdo#103665]: https://bugs.freedesktop.org/show_bug.cgi?id=103665
[fdo#104782]: https://bugs.freedesktop.org/show_bug.cgi?id=104782
[fdo#105363]: https://bugs.freedesktop.org/show_bug.cgi?id=105363
[fdo#105411]: https://bugs.freedesktop.org/show_bug.cgi?id=105411
[fdo#106641]: https://bugs.freedesktop.org/show_bug.cgi?id=106641
[fdo#107956]: https://bugs.freedesktop.org/show_bug.cgi?id=107956
[fdo#108145]: https://bugs.freedesktop.org/show_bug.cgi?id=108145
[fdo#108147]: https://bugs.freedesktop.org/show_bug.cgi?id=108147
[fdo#108597]: https://bugs.freedesktop.org/show_bug.cgi?id=108597
[fdo#108807]: https://bugs.freedesktop.org/show_bug.cgi?id=108807
[fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271
[fdo#109278]: https://bugs.freedesktop.org/show_bug.cgi?id=109278
[fdo#109373]: https://bugs.freedesktop.org/show_bug.cgi?id=109373
[fdo#109467]: https://bugs.freedesktop.org/show_bug.cgi?id=109467
[k.org#202321]: https://bugzilla.kernel.org/show_bug.cgi?id=202321

Participating hosts (6 -> 5)
------------------------------

Missing (1): shard-skl

Build changes
-------------

* IGT: IGT_4794 -> IGTPW_2305

CI_DRM_5492: bc2fcdf82a5b94f015126dfa9db03f88feb9ae17 @ git://anongit.freedesktop.org/gfx-ci/linux
IGTPW_2305: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_2305/
IGT_4794: 4a94878797999d1d2f7d224c6cf2e2855cd3109a @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools

== Logs ==

For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_2305/
_______________________________________________
igt-dev mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/igt-dev