* [PATCH] drm/bridge: it6505: Fix the read buffer array bound
@ 2022-02-28 8:14 ` Hsin-Yi Wang
0 siblings, 0 replies; 6+ messages in thread
From: Hsin-Yi Wang @ 2022-02-28 8:14 UTC (permalink / raw)
To: Robert Foss, David Airlie, Allen Chen
Cc: Neil Armstrong, Laurent Pinchart, Andrzej Hajda, Hermes Wu,
Daniel Vetter, AngeloGioacchino Del Regno, dri-devel,
linux-kernel, Mark Brown
The size of read_buf is READ_BUFFER_SIZE (200), so we can't access it
with read_buf + PAGE_SIZE (4096). Extend the READ_BUFFER_SIZE to 400 and
set the end position to read_buf + READ_BUFFER_SIZE.
Fixes: b5c84a9edcd418 ("drm/bridge: add it6505 driver")
Reported-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
---
drivers/gpu/drm/bridge/ite-it6505.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index fb16a176822d81..f2f101220ade94 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -289,7 +289,7 @@
#define WORD_LENGTH_20BIT 2
#define WORD_LENGTH_24BIT 3
#define DEBUGFS_DIR_NAME "it6505-debugfs"
-#define READ_BUFFER_SIZE 200
+#define READ_BUFFER_SIZE 400
/* Vendor option */
#define HDCP_DESIRED 1
@@ -3074,7 +3074,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf,
struct it6505 *it6505 = file->private_data;
struct drm_display_mode *vid = &it6505->video_info;
u8 read_buf[READ_BUFFER_SIZE];
- u8 *str = read_buf, *end = read_buf + PAGE_SIZE;
+ u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE;
ssize_t ret, count;
if (!it6505)
--
2.35.1.574.g5d30c73bfb-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH] drm/bridge: it6505: Fix the read buffer array bound
@ 2022-02-28 8:14 ` Hsin-Yi Wang
0 siblings, 0 replies; 6+ messages in thread
From: Hsin-Yi Wang @ 2022-02-28 8:14 UTC (permalink / raw)
To: Robert Foss, David Airlie, Allen Chen
Cc: Andrzej Hajda, Neil Armstrong, linux-kernel, dri-devel,
Hermes Wu, Mark Brown, Laurent Pinchart,
AngeloGioacchino Del Regno
The size of read_buf is READ_BUFFER_SIZE (200), so we can't access it
with read_buf + PAGE_SIZE (4096). Extend the READ_BUFFER_SIZE to 400 and
set the end position to read_buf + READ_BUFFER_SIZE.
Fixes: b5c84a9edcd418 ("drm/bridge: add it6505 driver")
Reported-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
---
drivers/gpu/drm/bridge/ite-it6505.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index fb16a176822d81..f2f101220ade94 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -289,7 +289,7 @@
#define WORD_LENGTH_20BIT 2
#define WORD_LENGTH_24BIT 3
#define DEBUGFS_DIR_NAME "it6505-debugfs"
-#define READ_BUFFER_SIZE 200
+#define READ_BUFFER_SIZE 400
/* Vendor option */
#define HDCP_DESIRED 1
@@ -3074,7 +3074,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf,
struct it6505 *it6505 = file->private_data;
struct drm_display_mode *vid = &it6505->video_info;
u8 read_buf[READ_BUFFER_SIZE];
- u8 *str = read_buf, *end = read_buf + PAGE_SIZE;
+ u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE;
ssize_t ret, count;
if (!it6505)
--
2.35.1.574.g5d30c73bfb-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/bridge: it6505: Fix the read buffer array bound
2022-02-28 8:14 ` Hsin-Yi Wang
@ 2022-02-28 15:13 ` Robert Foss
-1 siblings, 0 replies; 6+ messages in thread
From: Robert Foss @ 2022-02-28 15:13 UTC (permalink / raw)
To: Hsin-Yi Wang
Cc: David Airlie, Allen Chen, Neil Armstrong, Laurent Pinchart,
Andrzej Hajda, Hermes Wu, Daniel Vetter,
AngeloGioacchino Del Regno, dri-devel, linux-kernel, Mark Brown
On Mon, 28 Feb 2022 at 09:14, Hsin-Yi Wang <hsinyi@chromium.org> wrote:
>
> The size of read_buf is READ_BUFFER_SIZE (200), so we can't access it
> with read_buf + PAGE_SIZE (4096). Extend the READ_BUFFER_SIZE to 400 and
> set the end position to read_buf + READ_BUFFER_SIZE.
>
> Fixes: b5c84a9edcd418 ("drm/bridge: add it6505 driver")
> Reported-by: Mark Brown <broonie@kernel.org>
> Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
> ---
> drivers/gpu/drm/bridge/ite-it6505.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
> index fb16a176822d81..f2f101220ade94 100644
> --- a/drivers/gpu/drm/bridge/ite-it6505.c
> +++ b/drivers/gpu/drm/bridge/ite-it6505.c
> @@ -289,7 +289,7 @@
> #define WORD_LENGTH_20BIT 2
> #define WORD_LENGTH_24BIT 3
> #define DEBUGFS_DIR_NAME "it6505-debugfs"
> -#define READ_BUFFER_SIZE 200
> +#define READ_BUFFER_SIZE 400
>
> /* Vendor option */
> #define HDCP_DESIRED 1
> @@ -3074,7 +3074,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf,
> struct it6505 *it6505 = file->private_data;
> struct drm_display_mode *vid = &it6505->video_info;
> u8 read_buf[READ_BUFFER_SIZE];
> - u8 *str = read_buf, *end = read_buf + PAGE_SIZE;
> + u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE;
> ssize_t ret, count;
>
> if (!it6505)
> --
> 2.35.1.574.g5d30c73bfb-goog
>
Reviewed-by: Robert Foss <robert.foss@linaro.org>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/bridge: it6505: Fix the read buffer array bound
@ 2022-02-28 15:13 ` Robert Foss
0 siblings, 0 replies; 6+ messages in thread
From: Robert Foss @ 2022-02-28 15:13 UTC (permalink / raw)
To: Hsin-Yi Wang
Cc: Neil Armstrong, David Airlie, Allen Chen, linux-kernel,
dri-devel, Hermes Wu, Mark Brown, Laurent Pinchart,
Andrzej Hajda, AngeloGioacchino Del Regno
On Mon, 28 Feb 2022 at 09:14, Hsin-Yi Wang <hsinyi@chromium.org> wrote:
>
> The size of read_buf is READ_BUFFER_SIZE (200), so we can't access it
> with read_buf + PAGE_SIZE (4096). Extend the READ_BUFFER_SIZE to 400 and
> set the end position to read_buf + READ_BUFFER_SIZE.
>
> Fixes: b5c84a9edcd418 ("drm/bridge: add it6505 driver")
> Reported-by: Mark Brown <broonie@kernel.org>
> Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
> ---
> drivers/gpu/drm/bridge/ite-it6505.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
> index fb16a176822d81..f2f101220ade94 100644
> --- a/drivers/gpu/drm/bridge/ite-it6505.c
> +++ b/drivers/gpu/drm/bridge/ite-it6505.c
> @@ -289,7 +289,7 @@
> #define WORD_LENGTH_20BIT 2
> #define WORD_LENGTH_24BIT 3
> #define DEBUGFS_DIR_NAME "it6505-debugfs"
> -#define READ_BUFFER_SIZE 200
> +#define READ_BUFFER_SIZE 400
>
> /* Vendor option */
> #define HDCP_DESIRED 1
> @@ -3074,7 +3074,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf,
> struct it6505 *it6505 = file->private_data;
> struct drm_display_mode *vid = &it6505->video_info;
> u8 read_buf[READ_BUFFER_SIZE];
> - u8 *str = read_buf, *end = read_buf + PAGE_SIZE;
> + u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE;
> ssize_t ret, count;
>
> if (!it6505)
> --
> 2.35.1.574.g5d30c73bfb-goog
>
Reviewed-by: Robert Foss <robert.foss@linaro.org>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/bridge: it6505: Fix the read buffer array bound
2022-02-28 15:13 ` Robert Foss
@ 2022-03-01 12:59 ` Robert Foss
-1 siblings, 0 replies; 6+ messages in thread
From: Robert Foss @ 2022-03-01 12:59 UTC (permalink / raw)
To: Hsin-Yi Wang
Cc: David Airlie, Allen Chen, Neil Armstrong, Laurent Pinchart,
Andrzej Hajda, Hermes Wu, Daniel Vetter,
AngeloGioacchino Del Regno, dri-devel, linux-kernel, Mark Brown
Applied to drm-misc-next.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/bridge: it6505: Fix the read buffer array bound
@ 2022-03-01 12:59 ` Robert Foss
0 siblings, 0 replies; 6+ messages in thread
From: Robert Foss @ 2022-03-01 12:59 UTC (permalink / raw)
To: Hsin-Yi Wang
Cc: Neil Armstrong, David Airlie, Allen Chen, linux-kernel,
dri-devel, Hermes Wu, Mark Brown, Laurent Pinchart,
Andrzej Hajda, AngeloGioacchino Del Regno
Applied to drm-misc-next.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-03-01 12:59 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-28 8:14 [PATCH] drm/bridge: it6505: Fix the read buffer array bound Hsin-Yi Wang
2022-02-28 8:14 ` Hsin-Yi Wang
2022-02-28 15:13 ` Robert Foss
2022-02-28 15:13 ` Robert Foss
2022-03-01 12:59 ` Robert Foss
2022-03-01 12:59 ` Robert Foss
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.