From mboxrd@z Thu Jan  1 00:00:00 1970
From: Daniel Vetter <daniel@ffwll.ch>
Subject: Re: [Intel-gfx] [PATCH v2 2/2] drm/debugfs: add an "edid_override"
 file per connector
Date: Wed, 18 Jun 2014 22:08:07 +0200
Message-ID: <20140618200807.GV5821@phenom.ffwll.local>
References: <1401379063-15375-3-git-send-email-thomas.wood@intel.com>
 <1403110353-6137-1-git-send-email-thomas.wood@intel.com>
 <1403110353-6137-3-git-send-email-thomas.wood@intel.com>
 <CADnq5_Nioga9SfJqcHzqWvSApibUd=Sr6eE9s+GTnkbPWW+nnA@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <dri-devel-bounces@lists.freedesktop.org>
Received: from mail-wg0-f42.google.com (mail-wg0-f42.google.com [74.125.82.42])
 by gabe.freedesktop.org (Postfix) with ESMTP id E018972047
 for <dri-devel@lists.freedesktop.org>; Wed, 18 Jun 2014 13:08:14 -0700 (PDT)
Received: by mail-wg0-f42.google.com with SMTP id z12so1336322wgg.13
 for <dri-devel@lists.freedesktop.org>; Wed, 18 Jun 2014 13:08:14 -0700 (PDT)
Content-Disposition: inline
In-Reply-To: <CADnq5_Nioga9SfJqcHzqWvSApibUd=Sr6eE9s+GTnkbPWW+nnA@mail.gmail.com>
List-Unsubscribe: <http://lists.freedesktop.org/mailman/options/dri-devel>,
 <mailto:dri-devel-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <http://lists.freedesktop.org/archives/dri-devel>
List-Post: <mailto:dri-devel@lists.freedesktop.org>
List-Help: <mailto:dri-devel-request@lists.freedesktop.org?subject=help>
List-Subscribe: <http://lists.freedesktop.org/mailman/listinfo/dri-devel>,
 <mailto:dri-devel-request@lists.freedesktop.org?subject=subscribe>
Errors-To: dri-devel-bounces@lists.freedesktop.org
Sender: "dri-devel" <dri-devel-bounces@lists.freedesktop.org>
To: Alex Deucher <alexdeucher@gmail.com>
Cc: Intel Graphics Development <intel-gfx@lists.freedesktop.org>, Thomas Wood <thomas.wood@intel.com>, Maling list - DRI developers <dri-devel@lists.freedesktop.org>
List-Id: dri-devel@lists.freedesktop.org

On Wed, Jun 18, 2014 at 03:37:30PM -0400, Alex Deucher wrote:
> On Wed, Jun 18, 2014 at 12:52 PM, Thomas Wood <thomas.wood@intel.com> wrote:
> > +static ssize_t edid_write(struct file *file, const char __user *ubuf,
> > +                         size_t len, loff_t *offp)
> > +{
> > +       struct seq_file *m = file->private_data;
> > +       struct drm_connector *connector = m->private;
> > +       char *buf;
> > +       struct edid *edid;
> > +       int ret;
> > +
> > +       buf = memdup_user(ubuf, len);
> > +       if (IS_ERR(buf))
> > +               return PTR_ERR(buf);
> > +
> > +       edid = (struct edid *) buf;
> > +
> > +       if (len == 5 && !strncmp(buf, "reset", 5)) {
> > +               connector->override_edid = false;
> > +               ret = drm_mode_connector_update_edid_property(connector, NULL);
> > +       } else if (len < EDID_LENGTH ||
> > +                  EDID_LENGTH * (1 + edid->extensions) > len)
> > +               ret = -EINVAL;
> > +       else {
> > +               connector->override_edid = false;
> 
> Might be worth doing some minimal validation of the EDID (e.g., make
> sure it has a valid header).

Actually we also have plans to abuse this for a bit of nasty EDID
injection to exercise our parser. So at most we should do just enough
checking to make sure the claimed edid length field agrees with the edid
itself (which we have), but beyond that any kind of garbage should be
allowed imo.
-Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch