[PATCH] drm: Make sure that encoder_type for drm_encoder_init() is in the list

[PATCH] drm: Make sure that encoder_type for drm_encoder_init() is in the list

[Jordan Crouse]

If a encoder name isn't specified for drm_encoder_init() it will try
to construct one based on the incoming encoder_type identifier. If the
caller passes an invalid encoder_type value the lookup could walk right
past the end of the table.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
---
 drivers/gpu/drm/drm_encoder.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/drm_encoder.c b/drivers/gpu/drm/drm_encoder.c
index 273e1c59c54a..4cf6c3bb8503 100644
--- a/drivers/gpu/drm/drm_encoder.c
+++ b/drivers/gpu/drm/drm_encoder.c
@@ -128,6 +128,12 @@ int drm_encoder_init(struct drm_device *dev,
 		encoder->name = kvasprintf(GFP_KERNEL, name, ap);
 		va_end(ap);
 	} else {
+		/* Make sure that the requested encoder type is in the list */
+		if (encoder_type >= ARRAY_SIZE(drm_encoder_enum_list)) {
+			ret = -EINVAL;
+			goto out_put;
+		}
+
 		encoder->name = kasprintf(GFP_KERNEL, "%s-%d",
 					  drm_encoder_enum_list[encoder_type].name,
 					  encoder->base.id);
-- 
2.17.1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm: Make sure that encoder_type for drm_encoder_init() is in the list

[Daniel Vetter]

On Thu, Jun 21, 2018 at 05:04:02PM -0600, Jordan Crouse wrote:
> If a encoder name isn't specified for drm_encoder_init() it will try
> to construct one based on the incoming encoder_type identifier. If the
> caller passes an invalid encoder_type value the lookup could walk right
> past the end of the table.
> 
> Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
> ---
>  drivers/gpu/drm/drm_encoder.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/gpu/drm/drm_encoder.c b/drivers/gpu/drm/drm_encoder.c
> index 273e1c59c54a..4cf6c3bb8503 100644
> --- a/drivers/gpu/drm/drm_encoder.c
> +++ b/drivers/gpu/drm/drm_encoder.c
> @@ -128,6 +128,12 @@ int drm_encoder_init(struct drm_device *dev,
>  		encoder->name = kvasprintf(GFP_KERNEL, name, ap);
>  		va_end(ap);
>  	} else {
> +		/* Make sure that the requested encoder type is in the list */
> +		if (encoder_type >= ARRAY_SIZE(drm_encoder_enum_list)) {

I think moving that to the top and wrapping it in a WARN_ON would be even
better - specifying and invalid encoder type is clearly a driver bug.
-Daniel

> +			ret = -EINVAL;
> +			goto out_put;
> +		}
> +
>  		encoder->name = kasprintf(GFP_KERNEL, "%s-%d",
>  					  drm_encoder_enum_list[encoder_type].name,
>  					  encoder->base.id);
> -- 
> 2.17.1
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm: Make sure that encoder_type for drm_encoder_init() is in the list

[Jordan Crouse]

On Fri, Jun 22, 2018 at 10:31:42AM +0200, Daniel Vetter wrote:
> On Thu, Jun 21, 2018 at 05:04:02PM -0600, Jordan Crouse wrote:
> > If a encoder name isn't specified for drm_encoder_init() it will try
> > to construct one based on the incoming encoder_type identifier. If the
> > caller passes an invalid encoder_type value the lookup could walk right
> > past the end of the table.
> > 
> > Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
> > ---
> >  drivers/gpu/drm/drm_encoder.c | 6 ++++++
> >  1 file changed, 6 insertions(+)
> > 
> > diff --git a/drivers/gpu/drm/drm_encoder.c b/drivers/gpu/drm/drm_encoder.c
> > index 273e1c59c54a..4cf6c3bb8503 100644
> > --- a/drivers/gpu/drm/drm_encoder.c
> > +++ b/drivers/gpu/drm/drm_encoder.c
> > @@ -128,6 +128,12 @@ int drm_encoder_init(struct drm_device *dev,
> >  		encoder->name = kvasprintf(GFP_KERNEL, name, ap);
> >  		va_end(ap);
> >  	} else {
> > +		/* Make sure that the requested encoder type is in the list */
> > +		if (encoder_type >= ARRAY_SIZE(drm_encoder_enum_list)) {
> 
> I think moving that to the top and wrapping it in a WARN_ON would be even
> better - specifying and invalid encoder type is clearly a driver bug.
> -Daniel

It wasn't immediately clear to me if it was legal to pass a "custom" encoder
type assuming you provided a name for it so I erred on the side of caution.
I would have no problem moving it up to the top and being loud about it.

Jordan

> > +			ret = -EINVAL;
> > +			goto out_put;
> > +		}
> > +
> >  		encoder->name = kasprintf(GFP_KERNEL, "%s-%d",
> >  					  drm_encoder_enum_list[encoder_type].name,
> >  					  encoder->base.id);
> > -- 
> > 2.17.1
> > 
> > _______________________________________________
> > dri-devel mailing list
> > dri-devel@lists.freedesktop.org
> > https://lists.freedesktop.org/mailman/listinfo/dri-devel
> 
> -- 
> Daniel Vetter
> Software Engineer, Intel Corporation
> http://blog.ffwll.ch

-- 
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm: Make sure that encoder_type for drm_encoder_init() is in the list

[Daniel Vetter]

On Fri, Jun 29, 2018 at 03:47:43PM -0600, Jordan Crouse wrote:
> If a encoder name isn't specified for drm_encoder_init() it will try
> to construct one based on the incoming encoder_type identifier. If the
> caller passes an invalid encoder_type value the lookup could walk right
> past the end of the table.
> 
> [v2: Use a WARN() at the top of the function as suggested by Daniel
>  Vetter]
> 
> Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Aside: Want drm-misc commit rights so you can push patches like these
yourself?

Might also be useful in case the group maintainership thing with msm
happens, just as prep.
-Daniel

> ---
>  drivers/gpu/drm/drm_encoder.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/gpu/drm/drm_encoder.c b/drivers/gpu/drm/drm_encoder.c
> index 273e1c59c54a..6228c2cee5f0 100644
> --- a/drivers/gpu/drm/drm_encoder.c
> +++ b/drivers/gpu/drm/drm_encoder.c
> @@ -114,6 +114,10 @@ int drm_encoder_init(struct drm_device *dev,
>  	if (WARN_ON(dev->mode_config.num_encoder >= 32))
>  		return -EINVAL;
>  
> +	/* Make sure that the requested encoder type is in the list */
> +	if (WARN_ON(encoder_type >= ARRAY_SIZE(drm_encoder_enum_list)))
> +		return -EINVAL;
> +
>  	ret = drm_mode_object_add(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
>  	if (ret)
>  		return ret;
> -- 
> 2.17.1
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[PATCH] drm: Make sure that encoder_type for drm_encoder_init() is in the list

[Jordan Crouse]

If a encoder name isn't specified for drm_encoder_init() it will try
to construct one based on the incoming encoder_type identifier. If the
caller passes an invalid encoder_type value the lookup could walk right
past the end of the table.

[v2: Use a WARN() at the top of the function as suggested by Daniel
 Vetter]

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
---
 drivers/gpu/drm/drm_encoder.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/drm_encoder.c b/drivers/gpu/drm/drm_encoder.c
index 273e1c59c54a..6228c2cee5f0 100644
--- a/drivers/gpu/drm/drm_encoder.c
+++ b/drivers/gpu/drm/drm_encoder.c
@@ -114,6 +114,10 @@ int drm_encoder_init(struct drm_device *dev,
 	if (WARN_ON(dev->mode_config.num_encoder >= 32))
 		return -EINVAL;
 
+	/* Make sure that the requested encoder type is in the list */
+	if (WARN_ON(encoder_type >= ARRAY_SIZE(drm_encoder_enum_list)))
+		return -EINVAL;
+
 	ret = drm_mode_object_add(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
 	if (ret)
 		return ret;
-- 
2.17.1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel