From: Chris Zhong <zyw@rock-chips.com>
To: John Keeping <john@metanate.com>, Mark Yao <mark.yao@rock-chips.com>
Cc: linux-rockchip@lists.infradead.org,
linux-arm-kernel@lists.infradead.org,
dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 07/26] drm/rockchip: dw-mipi-dsi: avoid out-of-bounds read on tx_buf
Date: Sun, 22 Jan 2017 14:42:30 +0800 [thread overview]
Message-ID: <58845456.2040501@rock-chips.com> (raw)
In-Reply-To: <20170121163128.22240-8-john@metanate.com>
Hi John
Reviewed-by: Chris Zhong <zyw@rock-chips.com>
On 01/22/2017 12:31 AM, John Keeping wrote:
> As a side-effect of this, encode the endianness explicitly rather than
> casting a u16.
>
> Signed-off-by: John Keeping <john@metanate.com>
> ---
> Unchanged in v2
> ---
> drivers/gpu/drm/rockchip/dw-mipi-dsi.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/rockchip/dw-mipi-dsi.c b/drivers/gpu/drm/rockchip/dw-mipi-dsi.c
> index 4be1ff3a42bb..2e6ad4591ebf 100644
> --- a/drivers/gpu/drm/rockchip/dw-mipi-dsi.c
> +++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi.c
> @@ -572,8 +572,13 @@ static int dw_mipi_dsi_gen_pkt_hdr_write(struct dw_mipi_dsi *dsi, u32 hdr_val)
> static int dw_mipi_dsi_dcs_short_write(struct dw_mipi_dsi *dsi,
> const struct mipi_dsi_msg *msg)
> {
> - const u16 *tx_buf = msg->tx_buf;
> - u32 val = GEN_HDATA(*tx_buf) | GEN_HTYPE(msg->type);
> + const u8 *tx_buf = msg->tx_buf;
> + u32 val = GEN_HTYPE(msg->type);
> +
> + if (msg->tx_len > 0)
> + val |= GEN_HDATA(tx_buf[0]);
> + if (msg->tx_len > 1)
> + val |= GEN_HDATA(tx_buf[1] << 8);
>
> if (msg->tx_len > 2) {
> dev_err(dsi->dev, "too long tx buf length %zu for short write\n",
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2017-01-22 6:42 UTC|newest]
Thread overview: 50+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-21 16:31 [PATCH v2 00/26] drm/rockchip: MIPI fixes & improvements John Keeping
2017-01-21 16:31 ` [PATCH v2 01/26] drm/rockchip: dw-mipi-dsi: don't configure hardware in mode_set for MIPI John Keeping
2017-01-22 3:58 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 02/26] drm/rockchip: dw-mipi-dsi: rename commit hook to enable John Keeping
2017-01-21 16:31 ` [PATCH v2 03/26] drm/rockchip: dw-mipi-dsi: pass mode in where needed John Keeping
2017-01-22 4:00 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 04/26] drm/rockchip: dw-mipi-dsi: remove mode_set hook John Keeping
2017-01-22 6:08 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 05/26] drm/rockchip: dw-mipi-dsi: fix command header writes John Keeping
2017-01-21 16:31 ` [PATCH v2 06/26] drm/rockchip: dw-mipi-dsi: fix generic packet status check John Keeping
2017-01-22 6:24 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 07/26] drm/rockchip: dw-mipi-dsi: avoid out-of-bounds read on tx_buf John Keeping
2017-01-22 6:42 ` Chris Zhong [this message]
2017-01-21 16:31 ` [PATCH v2 08/26] drm/rockchip: dw-mipi-dsi: include bad value in error message John Keeping
2017-01-22 6:44 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 09/26] drm/rockchip: dw-mipi-dsi: respect message flags John Keeping
2017-01-22 7:14 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 10/26] drm/rockchip: dw-mipi-dsi: only request HS clock when required John Keeping
2017-01-22 8:10 ` Chris Zhong
[not found] ` <20170121163128.22240-1-john-HooS5bfzL4hWk0Htik3J/w@public.gmane.org>
2017-01-21 16:31 ` [PATCH v2 11/26] drm/rockchip: dw-mipi-dsi: don't assume buffer is aligned John Keeping
2017-01-22 8:16 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 12/26] drm/rockchip: dw-mipi-dsi: prepare panel after phy init John Keeping
2017-01-22 8:22 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 13/26] drm/rockchip: dw-mipi-dsi: allow commands in panel_disable John Keeping
2017-01-22 8:37 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 14/26] drm/rockchip: dw-mipi-dsi: fix escape clock rate John Keeping
2017-01-22 9:37 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 15/26] drm/rockchip: dw-mipi-dsi: ensure PHY is reset John Keeping
2017-01-22 9:37 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 16/26] drm/rockchip: dw-mipi-dsi: configure bias and bandgap before enable John Keeping
2017-01-21 16:31 ` [PATCH v2 17/26] drm/rockchip: dw-mipi-dsi: don't enable PHY PLL until it's configured John Keeping
2017-01-22 10:07 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 18/26] drm/rockchip: dw-mipi-dsi: properly configure PHY timing John Keeping
2017-01-22 3:06 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 19/26] drm/rockchip: dw-mipi-dsi: improve PLL configuration John Keeping
2017-01-23 1:38 ` Chris Zhong
2017-01-23 12:49 ` John Keeping
2017-01-24 2:42 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 20/26] drm/rockchip: dw-mipi-dsi: use specific poll helper John Keeping
2017-01-23 0:49 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 21/26] drm/rockchip: dw-mipi-dsi: use positive check for N{H, V}SYNC John Keeping
2017-01-21 16:31 ` [PATCH v2 22/26] drm/rockchip: vop: test for P{H,V}SYNC John Keeping
2017-01-23 7:12 ` Mark yao
2017-01-21 16:31 ` [PATCH v2 23/26] drm/rockchip: dw-mipi-dsi: defer probe if panel is not loaded John Keeping
2017-01-21 16:31 ` [PATCH v2 24/26] drm/rockchip: dw-mipi-dsi: support non-burst modes John Keeping
2017-01-23 6:11 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 25/26] drm/rockchip: dw-mipi-dsi: add reset control John Keeping
2017-01-23 6:12 ` Chris Zhong
2017-01-21 16:31 ` [PATCH v2 26/26] drm/rockchip: dw-mipi-dsi: support read commands John Keeping
2017-01-22 3:08 ` Chris Zhong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=58845456.2040501@rock-chips.com \
--to=zyw@rock-chips.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=john@metanate.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rockchip@lists.infradead.org \
--cc=mark.yao@rock-chips.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).