| Message ID | 20220228081421.1504213-1-hsinyi@chromium.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/bridge: it6505: Fix the read buffer array bound | expand |
On Mon, 28 Feb 2022 at 09:14, Hsin-Yi Wang <hsinyi@chromium.org> wrote: > > The size of read_buf is READ_BUFFER_SIZE (200), so we can't access it > with read_buf + PAGE_SIZE (4096). Extend the READ_BUFFER_SIZE to 400 and > set the end position to read_buf + READ_BUFFER_SIZE. > > Fixes: b5c84a9edcd418 ("drm/bridge: add it6505 driver") > Reported-by: Mark Brown <broonie@kernel.org> > Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org> > --- > drivers/gpu/drm/bridge/ite-it6505.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c > index fb16a176822d81..f2f101220ade94 100644 > --- a/drivers/gpu/drm/bridge/ite-it6505.c > +++ b/drivers/gpu/drm/bridge/ite-it6505.c > @@ -289,7 +289,7 @@ > #define WORD_LENGTH_20BIT 2 > #define WORD_LENGTH_24BIT 3 > #define DEBUGFS_DIR_NAME "it6505-debugfs" > -#define READ_BUFFER_SIZE 200 > +#define READ_BUFFER_SIZE 400 > > /* Vendor option */ > #define HDCP_DESIRED 1 > @@ -3074,7 +3074,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf, > struct it6505 *it6505 = file->private_data; > struct drm_display_mode *vid = &it6505->video_info; > u8 read_buf[READ_BUFFER_SIZE]; > - u8 *str = read_buf, *end = read_buf + PAGE_SIZE; > + u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE; > ssize_t ret, count; > > if (!it6505) > -- > 2.35.1.574.g5d30c73bfb-goog > Reviewed-by: Robert Foss <robert.foss@linaro.org>
Applied to drm-misc-next.
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c index fb16a176822d81..f2f101220ade94 100644 --- a/drivers/gpu/drm/bridge/ite-it6505.c +++ b/drivers/gpu/drm/bridge/ite-it6505.c @@ -289,7 +289,7 @@ #define WORD_LENGTH_20BIT 2 #define WORD_LENGTH_24BIT 3 #define DEBUGFS_DIR_NAME "it6505-debugfs" -#define READ_BUFFER_SIZE 200 +#define READ_BUFFER_SIZE 400 /* Vendor option */ #define HDCP_DESIRED 1 @@ -3074,7 +3074,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf, struct it6505 *it6505 = file->private_data; struct drm_display_mode *vid = &it6505->video_info; u8 read_buf[READ_BUFFER_SIZE]; - u8 *str = read_buf, *end = read_buf + PAGE_SIZE; + u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE; ssize_t ret, count; if (!it6505)
The size of read_buf is READ_BUFFER_SIZE (200), so we can't access it with read_buf + PAGE_SIZE (4096). Extend the READ_BUFFER_SIZE to 400 and set the end position to read_buf + READ_BUFFER_SIZE. Fixes: b5c84a9edcd418 ("drm/bridge: add it6505 driver") Reported-by: Mark Brown <broonie@kernel.org> Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org> --- drivers/gpu/drm/bridge/ite-it6505.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)