| Message ID | 20180411010330.17866-1-labbott@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Tue, Apr 10, 2018 at 6:03 PM, Laura Abbott <labbott@redhat.com> wrote: > There's an ongoing effort to remove VLAs[1] from the kernel to eventually > turn on -Wvla. The vla in reg_write_range is based on the length of data > passed. The one use of a non-constant size for this range is bounded by > the size buffer passed to hdmi_infoframe_pack which is a fixed size. > Switch to this upper bound. > > [1] https://lkml.org/lkml/2018/3/7/621 > > Signed-off-by: Laura Abbott <labbott@redhat.com> Reviewed-by: Kees Cook <keescook@chromium.org> Same question for this patch: who's best to take this? Thanks! -Kees > --- > v2: Switch to make the buffer size more transparent and add a bounds > check. > --- > drivers/gpu/drm/i2c/tda998x_drv.c | 13 +++++++++++-- > 1 file changed, 11 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c > index 9e67a7b4e3a4..c8b6029b7839 100644 > --- a/drivers/gpu/drm/i2c/tda998x_drv.c > +++ b/drivers/gpu/drm/i2c/tda998x_drv.c > @@ -466,13 +466,22 @@ reg_read_range(struct tda998x_priv *priv, u16 reg, char *buf, int cnt) > return ret; > } > > +#define MAX_WRITE_RANGE_BUF 32 > + > static void > reg_write_range(struct tda998x_priv *priv, u16 reg, u8 *p, int cnt) > { > struct i2c_client *client = priv->hdmi; > - u8 buf[cnt+1]; > + /* This is the maximum size of the buffer passed in */ > + u8 buf[MAX_WRITE_RANGE_BUF + 1]; > int ret; > > + if (cnt > MAX_WRITE_RANGE_BUF) { > + dev_err(&client->dev, "Fixed write buffer too small (%d)\n", > + MAX_WRITE_RANGE_BUF); > + return; > + } > + > buf[0] = REG2ADDR(reg); > memcpy(&buf[1], p, cnt); > > @@ -679,7 +688,7 @@ static void > tda998x_write_if(struct tda998x_priv *priv, u8 bit, u16 addr, > union hdmi_infoframe *frame) > { > - u8 buf[32]; > + u8 buf[MAX_WRITE_RANGE_BUF]; > ssize_t len; > > len = hdmi_infoframe_pack(frame, buf, sizeof(buf)); > -- > 2.14.3 >
On Fri, May 18, 2018 at 11:01:55AM -0700, Kees Cook wrote: > On Tue, Apr 10, 2018 at 6:03 PM, Laura Abbott <labbott@redhat.com> wrote: > > There's an ongoing effort to remove VLAs[1] from the kernel to eventually > > turn on -Wvla. The vla in reg_write_range is based on the length of data > > passed. The one use of a non-constant size for this range is bounded by > > the size buffer passed to hdmi_infoframe_pack which is a fixed size. > > Switch to this upper bound. > > > > [1] https://lkml.org/lkml/2018/3/7/621 > > > > Signed-off-by: Laura Abbott <labbott@redhat.com> > > Reviewed-by: Kees Cook <keescook@chromium.org> > > Same question for this patch: who's best to take this? I had decided that I'm not taking any tda998x stuff until we get the CEC support merged upstream, as that has been hanging around for ages. Progress has been slow on that, but it finally got to the point where everyone was happy with it, and I sent a pull request to David Airlie on April 24th for it. Unfortunately, that pull request has not been actioned to date. I've sent a chaser, and last night, I checked with David Airlie on IRC. It seems David is not aware of my pull request. David says he'll look into this on Monday. Until David does take it, I can't add anything further to my git tree for tda998x development, as that would change what was sent to David back in April. The alternative would be for drm-misc to take it - I don't think it will conflict with anything I've already asked David to take, so that should be a safe route for _this_ patch.
On Sat, May 19, 2018 at 11:07:08AM +0100, Russell King - ARM Linux wrote: > On Fri, May 18, 2018 at 11:01:55AM -0700, Kees Cook wrote: > > On Tue, Apr 10, 2018 at 6:03 PM, Laura Abbott <labbott@redhat.com> wrote: > > > There's an ongoing effort to remove VLAs[1] from the kernel to eventually > > > turn on -Wvla. The vla in reg_write_range is based on the length of data > > > passed. The one use of a non-constant size for this range is bounded by > > > the size buffer passed to hdmi_infoframe_pack which is a fixed size. > > > Switch to this upper bound. > > > > > > [1] https://lkml.org/lkml/2018/3/7/621 > > > > > > Signed-off-by: Laura Abbott <labbott@redhat.com> > > > > Reviewed-by: Kees Cook <keescook@chromium.org> > > > > Same question for this patch: who's best to take this? > > I had decided that I'm not taking any tda998x stuff until we get the > CEC support merged upstream, as that has been hanging around for ages. > Progress has been slow on that, but it finally got to the point where > everyone was happy with it, and I sent a pull request to David Airlie > on April 24th for it. > > Unfortunately, that pull request has not been actioned to date. I've > sent a chaser, and last night, I checked with David Airlie on IRC. > It seems David is not aware of my pull request. David says he'll look > into this on Monday. > > Until David does take it, I can't add anything further to my git tree > for tda998x development, as that would change what was sent to David > back in April. > > The alternative would be for drm-misc to take it - I don't think it > will conflict with anything I've already asked David to take, so that > should be a safe route for _this_ patch. Sounds reasonable, applied to drm-misc-next for 4.19 just to make sure it won't get lost. Thanks, Daniel
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c index 9e67a7b4e3a4..c8b6029b7839 100644 --- a/drivers/gpu/drm/i2c/tda998x_drv.c +++ b/drivers/gpu/drm/i2c/tda998x_drv.c @@ -466,13 +466,22 @@ reg_read_range(struct tda998x_priv *priv, u16 reg, char *buf, int cnt) return ret; } +#define MAX_WRITE_RANGE_BUF 32 + static void reg_write_range(struct tda998x_priv *priv, u16 reg, u8 *p, int cnt) { struct i2c_client *client = priv->hdmi; - u8 buf[cnt+1]; + /* This is the maximum size of the buffer passed in */ + u8 buf[MAX_WRITE_RANGE_BUF + 1]; int ret; + if (cnt > MAX_WRITE_RANGE_BUF) { + dev_err(&client->dev, "Fixed write buffer too small (%d)\n", + MAX_WRITE_RANGE_BUF); + return; + } + buf[0] = REG2ADDR(reg); memcpy(&buf[1], p, cnt); @@ -679,7 +688,7 @@ static void tda998x_write_if(struct tda998x_priv *priv, u8 bit, u16 addr, union hdmi_infoframe *frame) { - u8 buf[32]; + u8 buf[MAX_WRITE_RANGE_BUF]; ssize_t len; len = hdmi_infoframe_pack(frame, buf, sizeof(buf));
There's an ongoing effort to remove VLAs[1] from the kernel to eventually turn on -Wvla. The vla in reg_write_range is based on the length of data passed. The one use of a non-constant size for this range is bounded by the size buffer passed to hdmi_infoframe_pack which is a fixed size. Switch to this upper bound. [1] https://lkml.org/lkml/2018/3/7/621 Signed-off-by: Laura Abbott <labbott@redhat.com> --- v2: Switch to make the buffer size more transparent and add a bounds check. --- drivers/gpu/drm/i2c/tda998x_drv.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)