From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paulo Zanoni Subject: [PATCH 2/5] drm/i915: WARN if the DP aux read is too big Date: Thu, 12 Sep 2013 13:58:18 -0300 Message-ID: <1379005101-1500-2-git-send-email-przanoni@gmail.com> References: <1379005101-1500-1-git-send-email-przanoni@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail-vc0-f177.google.com (mail-vc0-f177.google.com [209.85.220.177]) by gabe.freedesktop.org (Postfix) with ESMTP id 21D84E7CA2 for ; Thu, 12 Sep 2013 09:58:48 -0700 (PDT) Received: by mail-vc0-f177.google.com with SMTP id gf12so50023vcb.36 for ; Thu, 12 Sep 2013 09:58:47 -0700 (PDT) In-Reply-To: <1379005101-1500-1-git-send-email-przanoni@gmail.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: intel-gfx-bounces+gcfxdi-intel-gfx=m.gmane.org@lists.freedesktop.org Errors-To: intel-gfx-bounces+gcfxdi-intel-gfx=m.gmane.org@lists.freedesktop.org To: intel-gfx@lists.freedesktop.org Cc: Paulo Zanoni List-Id: intel-gfx@lists.freedesktop.org From: Paulo Zanoni So far we control all the reads an none of them exceeds the current limit of 20 bytes, but we never think about this when reviewing patches, so add a big WARN. In case we ever hit that WARN, we whould change the size of the reply array. Signed-off-by: Paulo Zanoni --- drivers/gpu/drm/i915/intel_dp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c index 20e468c..f30b691 100644 --- a/drivers/gpu/drm/i915/intel_dp.c +++ b/drivers/gpu/drm/i915/intel_dp.c @@ -577,6 +577,8 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp, msg_bytes = 4; reply_bytes = recv_bytes + 1; + if (WARN_ON(reply_bytes > sizeof(reply))) + return -E2BIG; for (;;) { ret = intel_dp_aux_ch(intel_dp, msg, msg_bytes, -- 1.8.3.1