Re: [PATCH] drm/dp/mst: zero out i2c read msg before sending

[Daniel Vetter <daniel@ffwll.ch>]

On Wed, Oct 14, 2015 at 04:07:20PM +1000, Dave Airlie wrote:
> From: Dave Airlie <airlied@redhat.com>
> 
> This avoids some of the fields being random garbage.
> 
> found this while debugging some other pain.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Dave Airlie <airlied@redhat.com>

Sligthly more serious is that we have a hardcoded limit on the number of
i2c transactions we accept of 4 and we never check that anywhere. And
that's supplied by userspace through i2c-dev nodes potentially and a few
lines below we just loop over that array.

Ofc the mst_i2c_xfer isn't really compliant in general since it doesn't
process any kind of i2c transactions but only those that drm_edid feeds it
(more or less). But that's another topic, but checking num < 4 is an easy
buffer overflow.

With that addressed too this is Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Cheers, Daniel
> ---
>  drivers/gpu/drm/drm_dp_mst_topology.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
> index ac3c273..2e4f8a3 100644
> --- a/drivers/gpu/drm/drm_dp_mst_topology.c
> +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
> @@ -2627,6 +2627,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs
>  		goto out;
>  	}
>  
> +	memset(&msg, 0, sizeof(msg));
>  	msg.req_type = DP_REMOTE_I2C_READ;
>  	msg.u.i2c_read.num_transactions = num - 1;
>  	msg.u.i2c_read.port_number = port->port_num;
> -- 
> 2.4.3
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel