* [PATCH] drm/dp/mst: zero out i2c read msg before sending
@ 2015-10-14 6:07 Dave Airlie
2015-10-14 8:01 ` Daniel Vetter
0 siblings, 1 reply; 2+ messages in thread
From: Dave Airlie @ 2015-10-14 6:07 UTC (permalink / raw)
To: dri-devel
From: Dave Airlie <airlied@redhat.com>
This avoids some of the fields being random garbage.
found this while debugging some other pain.
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
---
drivers/gpu/drm/drm_dp_mst_topology.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index ac3c273..2e4f8a3 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -2627,6 +2627,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs
goto out;
}
+ memset(&msg, 0, sizeof(msg));
msg.req_type = DP_REMOTE_I2C_READ;
msg.u.i2c_read.num_transactions = num - 1;
msg.u.i2c_read.port_number = port->port_num;
--
2.4.3
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] drm/dp/mst: zero out i2c read msg before sending
2015-10-14 6:07 [PATCH] drm/dp/mst: zero out i2c read msg before sending Dave Airlie
@ 2015-10-14 8:01 ` Daniel Vetter
0 siblings, 0 replies; 2+ messages in thread
From: Daniel Vetter @ 2015-10-14 8:01 UTC (permalink / raw)
To: Dave Airlie; +Cc: dri-devel
On Wed, Oct 14, 2015 at 04:07:20PM +1000, Dave Airlie wrote:
> From: Dave Airlie <airlied@redhat.com>
>
> This avoids some of the fields being random garbage.
>
> found this while debugging some other pain.
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Dave Airlie <airlied@redhat.com>
Sligthly more serious is that we have a hardcoded limit on the number of
i2c transactions we accept of 4 and we never check that anywhere. And
that's supplied by userspace through i2c-dev nodes potentially and a few
lines below we just loop over that array.
Ofc the mst_i2c_xfer isn't really compliant in general since it doesn't
process any kind of i2c transactions but only those that drm_edid feeds it
(more or less). But that's another topic, but checking num < 4 is an easy
buffer overflow.
With that addressed too this is Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Cheers, Daniel
> ---
> drivers/gpu/drm/drm_dp_mst_topology.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
> index ac3c273..2e4f8a3 100644
> --- a/drivers/gpu/drm/drm_dp_mst_topology.c
> +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
> @@ -2627,6 +2627,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs
> goto out;
> }
>
> + memset(&msg, 0, sizeof(msg));
> msg.req_type = DP_REMOTE_I2C_READ;
> msg.u.i2c_read.num_transactions = num - 1;
> msg.u.i2c_read.port_number = port->port_num;
> --
> 2.4.3
>
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-10-14 7:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-10-14 6:07 [PATCH] drm/dp/mst: zero out i2c read msg before sending Dave Airlie
2015-10-14 8:01 ` Daniel Vetter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.