All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
To: Rob Clark <robdclark@gmail.com>
Cc: Liviu Dudau <Liviu.Dudau@arm.com>,
	Jani Nikula <jani.nikula@intel.com>,
	Daniel Vetter <daniel.vetter@ffwll.ch>,
	Eric Engestrom <eric@engestrom.ch>,
	LKML <linux-kernel@vger.kernel.org>,
	DRI devel <dri-devel@lists.freedesktop.org>
Subject: Re: [PATCH] drm: check for NULL parameter in exported drm_get_format_name() function.
Date: Tue, 22 Nov 2016 19:31:57 +0200	[thread overview]
Message-ID: <20161122173157.GD31595@intel.com> (raw)
In-Reply-To: <CAF6AEGs=W8Me6T1qLiq2UEoWQg2+eYNRvw+5W11CXM7CAYBZKg@mail.gmail.com>

On Tue, Nov 22, 2016 at 12:23:59PM -0500, Rob Clark wrote:
> On Tue, Nov 22, 2016 at 11:50 AM, Ville Syrjälä
> <ville.syrjala@linux.intel.com> wrote:
> > On Tue, Nov 22, 2016 at 04:41:06PM +0000, Liviu Dudau wrote:
> >> drm_get_format_name() de-references the buf parameter without checking
> >> if the pointer was not NULL. Given that the function is EXPORT-ed, lets
> >> sanitise the parameters before proceeding.
> >>
> >> Fixes: b3c11ac267d461d3d5 ("drm: move allocation out of drm_get_format_name())
> >> Cc: Eric Engestrom <eric@engestrom.ch>
> >> Cc: Rob Clark <robdclark@gmail.com>
> >> Cc: Jani Nikula <jani.nikula@intel.com>
> >> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> >>
> >> Signed-off-by: Liviu Dudau <Liviu.Dudau@arm.com>
> >> ---
> >>  drivers/gpu/drm/drm_fourcc.c | 3 +++
> >>  1 file changed, 3 insertions(+)
> >>
> >> diff --git a/drivers/gpu/drm/drm_fourcc.c b/drivers/gpu/drm/drm_fourcc.c
> >> index 90d2cc8..0a3ff0b 100644
> >> --- a/drivers/gpu/drm/drm_fourcc.c
> >> +++ b/drivers/gpu/drm/drm_fourcc.c
> >> @@ -85,6 +85,9 @@ EXPORT_SYMBOL(drm_mode_legacy_fb_format);
> >>   */
> >>  const char *drm_get_format_name(uint32_t format, struct drm_format_name_buf *buf)
> >>  {
> >> +     if (!buf)
> >> +             return NULL;
> >> +
> >
> > Seems rather pointless to me. Why would you ever pass NULL to this guy?
> 
> perhaps BUG_ON(!buf)...

And how does that differ from just buf->foo?

> 
> BR,
> -R
> 
> >>       snprintf(buf->str, sizeof(buf->str),
> >>                "%c%c%c%c %s-endian (0x%08x)",
> >>                printable_char(format & 0xff),
> >> --
> >> 2.10.2
> >>
> >> _______________________________________________
> >> dri-devel mailing list
> >> dri-devel@lists.freedesktop.org
> >> https://lists.freedesktop.org/mailman/listinfo/dri-devel
> >
> > --
> > Ville Syrjälä
> > Intel OTC
> > _______________________________________________
> > dri-devel mailing list
> > dri-devel@lists.freedesktop.org
> > https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Ville Syrjälä
Intel OTC

WARNING: multiple messages have this Message-ID (diff)
From: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
To: Rob Clark <robdclark@gmail.com>
Cc: Jani Nikula <jani.nikula@intel.com>,
	Daniel Vetter <daniel.vetter@ffwll.ch>,
	Eric Engestrom <eric@engestrom.ch>,
	Liviu Dudau <Liviu.Dudau@arm.com>,
	LKML <linux-kernel@vger.kernel.org>,
	DRI devel <dri-devel@lists.freedesktop.org>
Subject: Re: [PATCH] drm: check for NULL parameter in exported drm_get_format_name() function.
Date: Tue, 22 Nov 2016 19:31:57 +0200	[thread overview]
Message-ID: <20161122173157.GD31595@intel.com> (raw)
In-Reply-To: <CAF6AEGs=W8Me6T1qLiq2UEoWQg2+eYNRvw+5W11CXM7CAYBZKg@mail.gmail.com>

On Tue, Nov 22, 2016 at 12:23:59PM -0500, Rob Clark wrote:
> On Tue, Nov 22, 2016 at 11:50 AM, Ville Syrjälä
> <ville.syrjala@linux.intel.com> wrote:
> > On Tue, Nov 22, 2016 at 04:41:06PM +0000, Liviu Dudau wrote:
> >> drm_get_format_name() de-references the buf parameter without checking
> >> if the pointer was not NULL. Given that the function is EXPORT-ed, lets
> >> sanitise the parameters before proceeding.
> >>
> >> Fixes: b3c11ac267d461d3d5 ("drm: move allocation out of drm_get_format_name())
> >> Cc: Eric Engestrom <eric@engestrom.ch>
> >> Cc: Rob Clark <robdclark@gmail.com>
> >> Cc: Jani Nikula <jani.nikula@intel.com>
> >> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> >>
> >> Signed-off-by: Liviu Dudau <Liviu.Dudau@arm.com>
> >> ---
> >>  drivers/gpu/drm/drm_fourcc.c | 3 +++
> >>  1 file changed, 3 insertions(+)
> >>
> >> diff --git a/drivers/gpu/drm/drm_fourcc.c b/drivers/gpu/drm/drm_fourcc.c
> >> index 90d2cc8..0a3ff0b 100644
> >> --- a/drivers/gpu/drm/drm_fourcc.c
> >> +++ b/drivers/gpu/drm/drm_fourcc.c
> >> @@ -85,6 +85,9 @@ EXPORT_SYMBOL(drm_mode_legacy_fb_format);
> >>   */
> >>  const char *drm_get_format_name(uint32_t format, struct drm_format_name_buf *buf)
> >>  {
> >> +     if (!buf)
> >> +             return NULL;
> >> +
> >
> > Seems rather pointless to me. Why would you ever pass NULL to this guy?
> 
> perhaps BUG_ON(!buf)...

And how does that differ from just buf->foo?

> 
> BR,
> -R
> 
> >>       snprintf(buf->str, sizeof(buf->str),
> >>                "%c%c%c%c %s-endian (0x%08x)",
> >>                printable_char(format & 0xff),
> >> --
> >> 2.10.2
> >>
> >> _______________________________________________
> >> dri-devel mailing list
> >> dri-devel@lists.freedesktop.org
> >> https://lists.freedesktop.org/mailman/listinfo/dri-devel
> >
> > --
> > Ville Syrjälä
> > Intel OTC
> > _______________________________________________
> > dri-devel mailing list
> > dri-devel@lists.freedesktop.org
> > https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Ville Syrjälä
Intel OTC
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

  reply	other threads:[~2016-11-22 17:32 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-11-22 16:41 [PATCH] drm: check for NULL parameter in exported drm_get_format_name() function Liviu Dudau
2016-11-22 16:41 ` Liviu Dudau
2016-11-22 16:50 ` Ville Syrjälä
2016-11-22 16:50   ` Ville Syrjälä
2016-11-22 17:23   ` Rob Clark
2016-11-22 17:23     ` Rob Clark
2016-11-22 17:31     ` Ville Syrjälä [this message]
2016-11-22 17:31       ` Ville Syrjälä
2016-11-22 17:35       ` Rob Clark
2016-11-22 17:35         ` Rob Clark
2016-11-22 18:06         ` Ville Syrjälä
2016-11-22 18:06           ` Ville Syrjälä
2016-11-22 18:15           ` Sean Paul
2016-11-22 18:15             ` Sean Paul
2016-11-22 18:47             ` Liviu Dudau
2016-11-22 18:47               ` Liviu Dudau
2016-11-22 21:46               ` Rob Clark
2016-11-22 21:46                 ` Rob Clark
2016-11-23 10:52         ` [PATCH v2] " Liviu Dudau
2016-11-23 10:52           ` Liviu Dudau
2016-11-23 11:00           ` Jani Nikula
2016-11-23 11:00             ` Jani Nikula
2016-11-23 11:23             ` Liviu Dudau
2016-11-23 11:23               ` Liviu Dudau
2016-11-23 12:26               ` Daniel Vetter
2016-11-23 12:26                 ` Daniel Vetter
2016-11-23 12:47                 ` Jani Nikula
2016-11-23 12:47                   ` Jani Nikula
2016-11-23 13:38                   ` Liviu Dudau
2016-11-23 13:38                     ` Liviu Dudau
2016-11-22 18:49     ` [PATCH] " Liviu Dudau
2016-11-22 18:49       ` Liviu Dudau

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20161122173157.GD31595@intel.com \
    --to=ville.syrjala@linux.intel.com \
    --cc=Liviu.Dudau@arm.com \
    --cc=daniel.vetter@ffwll.ch \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=eric@engestrom.ch \
    --cc=jani.nikula@intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=robdclark@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.