Re: [PATCH 2/5] drm/i915: fix intel_dp_aux_native_read's reply array size

[Jani Nikula <jani.nikula@linux.intel.com>]

On Fri, 13 Sep 2013, Paulo Zanoni <przanoni@gmail.com> wrote:
> From: Paulo Zanoni <paulo.r.zanoni@intel.com>
>
> So far we control all the reads an none of them exceeds the current
> limit of 20 bytes, but we never think about this when reviewing
> patches, so we may at some point in the future overflow the buffer.
>
> My initial patch just added a WARN in case we were about to overflow
> the buffer, but Chris suggested to make the size of the array dynamic.

VLA on stack in kernel gives me an uneasy feeling, but I'll survive.

intel_dp_aux_native_write() has a range check and an error return for
this. Maybe make the same change there, and add a
BUG_ON({send,recv}_bytes > 0x100) to both, since that's the max?

Jani.


> Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
> ---
>  drivers/gpu/drm/i915/intel_dp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
> index 20e468c..bf0b260 100644
> --- a/drivers/gpu/drm/i915/intel_dp.c
> +++ b/drivers/gpu/drm/i915/intel_dp.c
> @@ -564,7 +564,7 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp,
>  {
>  	uint8_t msg[4];
>  	int msg_bytes;
> -	uint8_t reply[20];
> +	uint8_t reply[recv_bytes + 1];
>  	int reply_bytes;
>  	uint8_t ack;
>  	int ret;
> -- 
> 1.8.3.1
>
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx

-- 
Jani Nikula, Intel Open Source Technology Center