diff mbox

[08/15] drm/i915/dsi: be defensive about out of bounds operation byte

Message ID 01c71ac89a9db8bc7b8ae0fb05c50a5fae362dc4.1450702954.git.jani.nikula@intel.com (mailing list archive)
State New, archived
Headers show

Commit Message

Jani Nikula Dec. 21, 2015, 1:10 p.m. UTC
Untie the VBT based generic panel driver from the VBT parsing, so that
the two don't have to be updated in lockstep.

Signed-off-by: Jani Nikula <jani.nikula@intel.com>
---
 drivers/gpu/drm/i915/intel_dsi_panel_vbt.c | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

Comments

Daniel Vetter Jan. 5, 2016, 2:15 p.m. UTC | #1
On Mon, Dec 21, 2015 at 03:10:59PM +0200, Jani Nikula wrote:
> Untie the VBT based generic panel driver from the VBT parsing, so that
> the two don't have to be updated in lockstep.
> 
> Signed-off-by: Jani Nikula <jani.nikula@intel.com>
> ---
>  drivers/gpu/drm/i915/intel_dsi_panel_vbt.c | 22 +++++++++-------------
>  1 file changed, 9 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
> index 45512e0df57a..ba5355506590 100644
> --- a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
> +++ b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
> @@ -232,11 +232,9 @@ static const u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, const u8 *data)
>  typedef const u8 * (*fn_mipi_elem_exec)(struct intel_dsi *intel_dsi,
>  					const u8 *data);
>  static const fn_mipi_elem_exec exec_elem[] = {
> -	NULL, /* reserved */
> -	mipi_exec_send_packet,
> -	mipi_exec_delay,
> -	mipi_exec_gpio,
> -	NULL, /* status read; later */
> +	[MIPI_SEQ_ELEM_SEND_PKT] = mipi_exec_send_packet,
> +	[MIPI_SEQ_ELEM_DELAY] = mipi_exec_delay,
> +	[MIPI_SEQ_ELEM_GPIO] = mipi_exec_gpio,
>  };
>  
>  /*
> @@ -264,7 +262,6 @@ static const char *sequence_name(enum mipi_seq seq_id)
>  static void generic_exec_sequence(struct intel_dsi *intel_dsi, const u8 *data)
>  {
>  	fn_mipi_elem_exec mipi_elem_exec;
> -	int index;
>  
>  	if (!data)
>  		return;
> @@ -277,15 +274,14 @@ static void generic_exec_sequence(struct intel_dsi *intel_dsi, const u8 *data)
>  
>  	/* parse each byte till we reach end of sequence byte - 0x00 */
>  	while (1) {
> -		index = *data;
> -		mipi_elem_exec = exec_elem[index];
> -		if (!mipi_elem_exec) {
> -			DRM_ERROR("Unsupported MIPI element, skipping sequence execution\n");
> +		u8 operation_byte = *data++;
> +		if (operation_byte >= ARRAY_SIZE(exec_elem) ||
> +		    !exec_elem[operation_byte]) {
> +			DRM_ERROR("Unsupported MIPI operation byte %u\n",

Maybe DRM_ERROR in the previous patch too? Just for ocd consistency.

Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

> +				  operation_byte);
>  			return;
>  		}
> -
> -		/* goto element payload */
> -		data++;
> +		mipi_elem_exec = exec_elem[operation_byte];
>  
>  		/* execute the element specific rotines */
>  		data = mipi_elem_exec(intel_dsi, data);
> -- 
> 2.1.4
> 
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx
Jani Nikula Jan. 5, 2016, 2:44 p.m. UTC | #2
On Tue, 05 Jan 2016, Daniel Vetter <daniel@ffwll.ch> wrote:
> On Mon, Dec 21, 2015 at 03:10:59PM +0200, Jani Nikula wrote:
>> Untie the VBT based generic panel driver from the VBT parsing, so that
>> the two don't have to be updated in lockstep.
>> 
>> Signed-off-by: Jani Nikula <jani.nikula@intel.com>
>> ---
>>  drivers/gpu/drm/i915/intel_dsi_panel_vbt.c | 22 +++++++++-------------
>>  1 file changed, 9 insertions(+), 13 deletions(-)
>> 
>> diff --git a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
>> index 45512e0df57a..ba5355506590 100644
>> --- a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
>> +++ b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
>> @@ -232,11 +232,9 @@ static const u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, const u8 *data)
>>  typedef const u8 * (*fn_mipi_elem_exec)(struct intel_dsi *intel_dsi,
>>  					const u8 *data);
>>  static const fn_mipi_elem_exec exec_elem[] = {
>> -	NULL, /* reserved */
>> -	mipi_exec_send_packet,
>> -	mipi_exec_delay,
>> -	mipi_exec_gpio,
>> -	NULL, /* status read; later */
>> +	[MIPI_SEQ_ELEM_SEND_PKT] = mipi_exec_send_packet,
>> +	[MIPI_SEQ_ELEM_DELAY] = mipi_exec_delay,
>> +	[MIPI_SEQ_ELEM_GPIO] = mipi_exec_gpio,
>>  };
>>  
>>  /*
>> @@ -264,7 +262,6 @@ static const char *sequence_name(enum mipi_seq seq_id)
>>  static void generic_exec_sequence(struct intel_dsi *intel_dsi, const u8 *data)
>>  {
>>  	fn_mipi_elem_exec mipi_elem_exec;
>> -	int index;
>>  
>>  	if (!data)
>>  		return;
>> @@ -277,15 +274,14 @@ static void generic_exec_sequence(struct intel_dsi *intel_dsi, const u8 *data)
>>  
>>  	/* parse each byte till we reach end of sequence byte - 0x00 */
>>  	while (1) {
>> -		index = *data;
>> -		mipi_elem_exec = exec_elem[index];
>> -		if (!mipi_elem_exec) {
>> -			DRM_ERROR("Unsupported MIPI element, skipping sequence execution\n");
>> +		u8 operation_byte = *data++;
>> +		if (operation_byte >= ARRAY_SIZE(exec_elem) ||
>> +		    !exec_elem[operation_byte]) {
>> +			DRM_ERROR("Unsupported MIPI operation byte %u\n",
>
> Maybe DRM_ERROR in the previous patch too? Just for ocd consistency.
>
> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Pushed up to and including this patch. I took the liberty of pushing
as-is, leaving the nitpicks for follow-up. Thanks for the review.

BR,
Jani.


>
>> +				  operation_byte);
>>  			return;
>>  		}
>> -
>> -		/* goto element payload */
>> -		data++;
>> +		mipi_elem_exec = exec_elem[operation_byte];
>>  
>>  		/* execute the element specific rotines */
>>  		data = mipi_elem_exec(intel_dsi, data);
>> -- 
>> 2.1.4
>> 
>> _______________________________________________
>> Intel-gfx mailing list
>> Intel-gfx@lists.freedesktop.org
>> http://lists.freedesktop.org/mailman/listinfo/intel-gfx
diff mbox

Patch

diff --git a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
index 45512e0df57a..ba5355506590 100644
--- a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
+++ b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
@@ -232,11 +232,9 @@  static const u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, const u8 *data)
 typedef const u8 * (*fn_mipi_elem_exec)(struct intel_dsi *intel_dsi,
 					const u8 *data);
 static const fn_mipi_elem_exec exec_elem[] = {
-	NULL, /* reserved */
-	mipi_exec_send_packet,
-	mipi_exec_delay,
-	mipi_exec_gpio,
-	NULL, /* status read; later */
+	[MIPI_SEQ_ELEM_SEND_PKT] = mipi_exec_send_packet,
+	[MIPI_SEQ_ELEM_DELAY] = mipi_exec_delay,
+	[MIPI_SEQ_ELEM_GPIO] = mipi_exec_gpio,
 };
 
 /*
@@ -264,7 +262,6 @@  static const char *sequence_name(enum mipi_seq seq_id)
 static void generic_exec_sequence(struct intel_dsi *intel_dsi, const u8 *data)
 {
 	fn_mipi_elem_exec mipi_elem_exec;
-	int index;
 
 	if (!data)
 		return;
@@ -277,15 +274,14 @@  static void generic_exec_sequence(struct intel_dsi *intel_dsi, const u8 *data)
 
 	/* parse each byte till we reach end of sequence byte - 0x00 */
 	while (1) {
-		index = *data;
-		mipi_elem_exec = exec_elem[index];
-		if (!mipi_elem_exec) {
-			DRM_ERROR("Unsupported MIPI element, skipping sequence execution\n");
+		u8 operation_byte = *data++;
+		if (operation_byte >= ARRAY_SIZE(exec_elem) ||
+		    !exec_elem[operation_byte]) {
+			DRM_ERROR("Unsupported MIPI operation byte %u\n",
+				  operation_byte);
 			return;
 		}
-
-		/* goto element payload */
-		data++;
+		mipi_elem_exec = exec_elem[operation_byte];
 
 		/* execute the element specific rotines */
 		data = mipi_elem_exec(intel_dsi, data);