| Message ID | 20180621230402.2866-1-jcrouse@codeaurora.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, Jun 21, 2018 at 05:04:02PM -0600, Jordan Crouse wrote: > If a encoder name isn't specified for drm_encoder_init() it will try > to construct one based on the incoming encoder_type identifier. If the > caller passes an invalid encoder_type value the lookup could walk right > past the end of the table. > > Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org> > --- > drivers/gpu/drm/drm_encoder.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/gpu/drm/drm_encoder.c b/drivers/gpu/drm/drm_encoder.c > index 273e1c59c54a..4cf6c3bb8503 100644 > --- a/drivers/gpu/drm/drm_encoder.c > +++ b/drivers/gpu/drm/drm_encoder.c > @@ -128,6 +128,12 @@ int drm_encoder_init(struct drm_device *dev, > encoder->name = kvasprintf(GFP_KERNEL, name, ap); > va_end(ap); > } else { > + /* Make sure that the requested encoder type is in the list */ > + if (encoder_type >= ARRAY_SIZE(drm_encoder_enum_list)) { I think moving that to the top and wrapping it in a WARN_ON would be even better - specifying and invalid encoder type is clearly a driver bug. -Daniel > + ret = -EINVAL; > + goto out_put; > + } > + > encoder->name = kasprintf(GFP_KERNEL, "%s-%d", > drm_encoder_enum_list[encoder_type].name, > encoder->base.id); > -- > 2.17.1 > > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/dri-devel
On Fri, Jun 22, 2018 at 10:31:42AM +0200, Daniel Vetter wrote: > On Thu, Jun 21, 2018 at 05:04:02PM -0600, Jordan Crouse wrote: > > If a encoder name isn't specified for drm_encoder_init() it will try > > to construct one based on the incoming encoder_type identifier. If the > > caller passes an invalid encoder_type value the lookup could walk right > > past the end of the table. > > > > Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org> > > --- > > drivers/gpu/drm/drm_encoder.c | 6 ++++++ > > 1 file changed, 6 insertions(+) > > > > diff --git a/drivers/gpu/drm/drm_encoder.c b/drivers/gpu/drm/drm_encoder.c > > index 273e1c59c54a..4cf6c3bb8503 100644 > > --- a/drivers/gpu/drm/drm_encoder.c > > +++ b/drivers/gpu/drm/drm_encoder.c > > @@ -128,6 +128,12 @@ int drm_encoder_init(struct drm_device *dev, > > encoder->name = kvasprintf(GFP_KERNEL, name, ap); > > va_end(ap); > > } else { > > + /* Make sure that the requested encoder type is in the list */ > > + if (encoder_type >= ARRAY_SIZE(drm_encoder_enum_list)) { > > I think moving that to the top and wrapping it in a WARN_ON would be even > better - specifying and invalid encoder type is clearly a driver bug. > -Daniel It wasn't immediately clear to me if it was legal to pass a "custom" encoder type assuming you provided a name for it so I erred on the side of caution. I would have no problem moving it up to the top and being loud about it. Jordan > > + ret = -EINVAL; > > + goto out_put; > > + } > > + > > encoder->name = kasprintf(GFP_KERNEL, "%s-%d", > > drm_encoder_enum_list[encoder_type].name, > > encoder->base.id); > > -- > > 2.17.1 > > > > _______________________________________________ > > dri-devel mailing list > > dri-devel@lists.freedesktop.org > > https://lists.freedesktop.org/mailman/listinfo/dri-devel > > -- > Daniel Vetter > Software Engineer, Intel Corporation > http://blog.ffwll.ch
diff --git a/drivers/gpu/drm/drm_encoder.c b/drivers/gpu/drm/drm_encoder.c index 273e1c59c54a..4cf6c3bb8503 100644 --- a/drivers/gpu/drm/drm_encoder.c +++ b/drivers/gpu/drm/drm_encoder.c @@ -128,6 +128,12 @@ int drm_encoder_init(struct drm_device *dev, encoder->name = kvasprintf(GFP_KERNEL, name, ap); va_end(ap); } else { + /* Make sure that the requested encoder type is in the list */ + if (encoder_type >= ARRAY_SIZE(drm_encoder_enum_list)) { + ret = -EINVAL; + goto out_put; + } + encoder->name = kasprintf(GFP_KERNEL, "%s-%d", drm_encoder_enum_list[encoder_type].name, encoder->base.id);
If a encoder name isn't specified for drm_encoder_init() it will try to construct one based on the incoming encoder_type identifier. If the caller passes an invalid encoder_type value the lookup could walk right past the end of the table. Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org> --- drivers/gpu/drm/drm_encoder.c | 6 ++++++ 1 file changed, 6 insertions(+)