All of lore.kernel.org
 help / color / mirror / Atom feed
From: Thomas Zimmermann <tzimmermann@suse.de>
To: airlied@redhat.com, sean@poorly.run, patrik.r.jakobsson@gmail.com
Cc: dri-devel@lists.freedesktop.org, Thomas Zimmermann <tzimmermann@suse.de>
Subject: [PATCH 5/9] drm/udl: Handle errors from usb_get_descriptor()
Date: Tue,  1 Apr 2025 18:12:15 +0200	[thread overview]
Message-ID: <20250401161929.283244-6-tzimmermann@suse.de> (raw)
In-Reply-To: <20250401161929.283244-1-tzimmermann@suse.de>

Reading the vendor descriptor from the udl device can fail with
an error, which the current code fails to capture. Store the return
value in an integer and test for the error. Abort parsing on errors
or treat the value as length on success.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
 drivers/gpu/drm/udl/udl_main.c | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 47fb6c34bfde3..4291ddb7158c4 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -31,28 +31,32 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl)
 	char *desc;
 	char *buf;
 	char *desc_end;
-
-	u8 total_len = 0;
+	int ret;
+	unsigned int len;
 
 	buf = kzalloc(MAX_VENDOR_DESCRIPTOR_SIZE, GFP_KERNEL);
 	if (!buf)
 		return false;
 	desc = buf;
 
-	total_len = usb_get_descriptor(udev, 0x5f, /* vendor specific */
-				    0, desc, MAX_VENDOR_DESCRIPTOR_SIZE);
-	if (total_len > 5) {
-		DRM_INFO("vendor descriptor length:%x data:%11ph\n",
-			total_len, desc);
+	ret = usb_get_descriptor(udev, 0x5f, /* vendor specific */
+				 0, desc, MAX_VENDOR_DESCRIPTOR_SIZE);
+	if (ret < 0)
+		goto unrecognized;
+	len = ret;
+
+	if (len > 5) {
+		DRM_INFO("vendor descriptor length: %u data:%11ph\n",
+			 len, desc);
 
-		if ((desc[0] != total_len) || /* descriptor length */
+		if ((desc[0] != len) ||    /* descriptor length */
 		    (desc[1] != 0x5f) ||   /* vendor descriptor type */
 		    (desc[2] != 0x01) ||   /* version (2 bytes) */
 		    (desc[3] != 0x00) ||
-		    (desc[4] != total_len - 2)) /* length after type */
+		    (desc[4] != len - 2))  /* length after type */
 			goto unrecognized;
 
-		desc_end = desc + total_len;
+		desc_end = desc + len;
 		desc += 5; /* the fixed header we've already parsed */
 
 		while (desc < desc_end) {
-- 
2.49.0


  parent reply	other threads:[~2025-04-01 16:23 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-04-01 16:12 [PATCH 0/9] drm/udl: Support adapters without vendor firmware descriptor Thomas Zimmermann
2025-04-01 16:12 ` [PATCH 1/9] drm/udl: Remove unused field dev from struct udl_device Thomas Zimmermann
2025-04-01 16:12 ` [PATCH 2/9] drm/udl: Remove unused field gem_lock " Thomas Zimmermann
2025-04-01 16:12 ` [PATCH 3/9] drm/udl: Improve type safety when using " Thomas Zimmermann
2025-04-01 16:12 ` [PATCH 4/9] drm/udl: The number of pixels is always positive Thomas Zimmermann
2025-04-01 16:12 ` Thomas Zimmermann [this message]
2025-04-01 16:12 ` [PATCH 6/9] drm/udl: Return error if vendor descriptor is too short Thomas Zimmermann
2025-04-02 13:16   ` Patrik Jakobsson
2025-04-03  7:28     ` Thomas Zimmermann
2025-04-03 11:06       ` Patrik Jakobsson
2025-04-01 16:12 ` [PATCH 7/9] drm/udl: Treat vendor descriptor as u8 Thomas Zimmermann
2025-04-01 16:12 ` [PATCH 8/9] drm/udl: Validate length in vendor-descriptor parser Thomas Zimmermann
2025-04-01 16:12 ` [PATCH 9/9] drm/udl: Support adapters without firmware descriptor Thomas Zimmermann
2025-04-03 11:03   ` Patrik Jakobsson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250401161929.283244-6-tzimmermann@suse.de \
    --to=tzimmermann@suse.de \
    --cc=airlied@redhat.com \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=patrik.r.jakobsson@gmail.com \
    --cc=sean@poorly.run \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.