[PATCHv2] drm/i2c: tda998x: Remove VLA usage

[PATCHv2] drm/i2c: tda998x: Remove VLA usage

[Laura Abbott]

There's an ongoing effort to remove VLAs[1] from the kernel to eventually
turn on -Wvla. The vla in reg_write_range is based on the length of data
passed. The one use of a non-constant size for this range is bounded by
the size buffer passed to hdmi_infoframe_pack which is a fixed size.
Switch to this upper bound.

[1] https://lkml.org/lkml/2018/3/7/621

Signed-off-by: Laura Abbott <labbott@redhat.com>
---
v2: Switch to make the buffer size more transparent and add a bounds
check.
---
 drivers/gpu/drm/i2c/tda998x_drv.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index 9e67a7b4e3a4..c8b6029b7839 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -466,13 +466,22 @@ reg_read_range(struct tda998x_priv *priv, u16 reg, char *buf, int cnt)
 	return ret;
 }
 
+#define MAX_WRITE_RANGE_BUF 32
+
 static void
 reg_write_range(struct tda998x_priv *priv, u16 reg, u8 *p, int cnt)
 {
 	struct i2c_client *client = priv->hdmi;
-	u8 buf[cnt+1];
+	/* This is the maximum size of the buffer passed in */
+	u8 buf[MAX_WRITE_RANGE_BUF + 1];
 	int ret;
 
+	if (cnt > MAX_WRITE_RANGE_BUF) {
+		dev_err(&client->dev, "Fixed write buffer too small (%d)\n",
+				MAX_WRITE_RANGE_BUF);
+		return;
+	}
+
 	buf[0] = REG2ADDR(reg);
 	memcpy(&buf[1], p, cnt);
 
@@ -679,7 +688,7 @@ static void
 tda998x_write_if(struct tda998x_priv *priv, u8 bit, u16 addr,
 		 union hdmi_infoframe *frame)
 {
-	u8 buf[32];
+	u8 buf[MAX_WRITE_RANGE_BUF];
 	ssize_t len;
 
 	len = hdmi_infoframe_pack(frame, buf, sizeof(buf));
-- 
2.14.3

Re: [PATCHv2] drm/i2c: tda998x: Remove VLA usage

[Kees Cook]

On Tue, Apr 10, 2018 at 6:03 PM, Laura Abbott <labbott@redhat.com> wrote:
> There's an ongoing effort to remove VLAs[1] from the kernel to eventually
> turn on -Wvla. The vla in reg_write_range is based on the length of data
> passed. The one use of a non-constant size for this range is bounded by
> the size buffer passed to hdmi_infoframe_pack which is a fixed size.
> Switch to this upper bound.
>
> [1] https://lkml.org/lkml/2018/3/7/621
>
> Signed-off-by: Laura Abbott <labbott@redhat.com>

Reviewed-by: Kees Cook <keescook@chromium.org>

Same question for this patch: who's best to take this?

Thanks!

-Kees

> ---
> v2: Switch to make the buffer size more transparent and add a bounds
> check.
> ---
>  drivers/gpu/drm/i2c/tda998x_drv.c | 13 +++++++++++--
>  1 file changed, 11 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
> index 9e67a7b4e3a4..c8b6029b7839 100644
> --- a/drivers/gpu/drm/i2c/tda998x_drv.c
> +++ b/drivers/gpu/drm/i2c/tda998x_drv.c
> @@ -466,13 +466,22 @@ reg_read_range(struct tda998x_priv *priv, u16 reg, char *buf, int cnt)
>         return ret;
>  }
>
> +#define MAX_WRITE_RANGE_BUF 32
> +
>  static void
>  reg_write_range(struct tda998x_priv *priv, u16 reg, u8 *p, int cnt)
>  {
>         struct i2c_client *client = priv->hdmi;
> -       u8 buf[cnt+1];
> +       /* This is the maximum size of the buffer passed in */
> +       u8 buf[MAX_WRITE_RANGE_BUF + 1];
>         int ret;
>
> +       if (cnt > MAX_WRITE_RANGE_BUF) {
> +               dev_err(&client->dev, "Fixed write buffer too small (%d)\n",
> +                               MAX_WRITE_RANGE_BUF);
> +               return;
> +       }
> +
>         buf[0] = REG2ADDR(reg);
>         memcpy(&buf[1], p, cnt);
>
> @@ -679,7 +688,7 @@ static void
>  tda998x_write_if(struct tda998x_priv *priv, u8 bit, u16 addr,
>                  union hdmi_infoframe *frame)
>  {
> -       u8 buf[32];
> +       u8 buf[MAX_WRITE_RANGE_BUF];
>         ssize_t len;
>
>         len = hdmi_infoframe_pack(frame, buf, sizeof(buf));
> --
> 2.14.3
>



-- 
Kees Cook
Pixel Security

Re: [PATCHv2] drm/i2c: tda998x: Remove VLA usage

[Russell King - ARM Linux]

On Fri, May 18, 2018 at 11:01:55AM -0700, Kees Cook wrote:
> On Tue, Apr 10, 2018 at 6:03 PM, Laura Abbott <labbott@redhat.com> wrote:
> > There's an ongoing effort to remove VLAs[1] from the kernel to eventually
> > turn on -Wvla. The vla in reg_write_range is based on the length of data
> > passed. The one use of a non-constant size for this range is bounded by
> > the size buffer passed to hdmi_infoframe_pack which is a fixed size.
> > Switch to this upper bound.
> >
> > [1] https://lkml.org/lkml/2018/3/7/621
> >
> > Signed-off-by: Laura Abbott <labbott@redhat.com>
> 
> Reviewed-by: Kees Cook <keescook@chromium.org>
> 
> Same question for this patch: who's best to take this?

I had decided that I'm not taking any tda998x stuff until we get the
CEC support merged upstream, as that has been hanging around for ages.
Progress has been slow on that, but it finally got to the point where
everyone was happy with it, and I sent a pull request to David Airlie
on April 24th for it.

Unfortunately, that pull request has not been actioned to date.  I've
sent a chaser, and last night, I checked with David Airlie on IRC.
It seems David is not aware of my pull request.  David says he'll look
into this on Monday.

Until David does take it, I can't add anything further to my git tree
for tda998x development, as that would change what was sent to David
back in April.

The alternative would be for drm-misc to take it - I don't think it
will conflict with anything I've already asked David to take, so that
should be a safe route for _this_ patch.

-- 
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 8.8Mbps down 630kbps up
According to speedtest.net: 8.21Mbps down 510kbps up

Re: [PATCHv2] drm/i2c: tda998x: Remove VLA usage

[Daniel Vetter]

On Sat, May 19, 2018 at 11:07:08AM +0100, Russell King - ARM Linux wrote:
> On Fri, May 18, 2018 at 11:01:55AM -0700, Kees Cook wrote:
> > On Tue, Apr 10, 2018 at 6:03 PM, Laura Abbott <labbott@redhat.com> wrote:
> > > There's an ongoing effort to remove VLAs[1] from the kernel to eventually
> > > turn on -Wvla. The vla in reg_write_range is based on the length of data
> > > passed. The one use of a non-constant size for this range is bounded by
> > > the size buffer passed to hdmi_infoframe_pack which is a fixed size.
> > > Switch to this upper bound.
> > >
> > > [1] https://lkml.org/lkml/2018/3/7/621
> > >
> > > Signed-off-by: Laura Abbott <labbott@redhat.com>
> > 
> > Reviewed-by: Kees Cook <keescook@chromium.org>
> > 
> > Same question for this patch: who's best to take this?
> 
> I had decided that I'm not taking any tda998x stuff until we get the
> CEC support merged upstream, as that has been hanging around for ages.
> Progress has been slow on that, but it finally got to the point where
> everyone was happy with it, and I sent a pull request to David Airlie
> on April 24th for it.
> 
> Unfortunately, that pull request has not been actioned to date.  I've
> sent a chaser, and last night, I checked with David Airlie on IRC.
> It seems David is not aware of my pull request.  David says he'll look
> into this on Monday.
> 
> Until David does take it, I can't add anything further to my git tree
> for tda998x development, as that would change what was sent to David
> back in April.
> 
> The alternative would be for drm-misc to take it - I don't think it
> will conflict with anything I've already asked David to take, so that
> should be a safe route for _this_ patch.

Sounds reasonable, applied to drm-misc-next for 4.19 just to make sure it
won't get lost.

Thanks, Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch