From: Kees Cook <keescook@chromium.org>
To: Alex Deucher <alexdeucher@gmail.com>
Cc: "Paulo Miguel Almeida" <paulo.miguel.almeida.rodenas@gmail.com>,
"Alex Deucher" <alexander.deucher@amd.com>,
"Christian König" <christian.koenig@amd.com>,
"Pan, Xinhui" <Xinhui.Pan@amd.com>,
"David Airlie" <airlied@gmail.com>,
"Daniel Vetter" <daniel@ffwll.ch>,
amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org,
linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org
Subject: Re: [PATCH v2] [next] drm/radeon: Replace one-element array with flexible-array member
Date: Tue, 1 Nov 2022 15:41:54 -0700 [thread overview]
Message-ID: <202211011538.B7548FDDE@keescook> (raw)
In-Reply-To: <CADnq5_Ou9HnZjQx5WaAZW+iu24g_eS2hh25xhExeQjdMOXYfCQ@mail.gmail.com>
On Tue, Nov 01, 2022 at 06:09:16PM -0400, Alex Deucher wrote:
> On Tue, Nov 1, 2022 at 5:54 PM Kees Cook <keescook@chromium.org> wrote:
> > Does the ROM always only have a single byte there? This seems unlikely
> > given the member "ucFakeEDIDLength" (and the code below).
>
> I'm not sure. I'm mostly concerned about this:
>
> record += fake_edid_record->ucFakeEDIDLength ?
> fake_edid_record->ucFakeEDIDLength + 2 :
> sizeof(ATOM_FAKE_EDID_PATCH_RECORD);
But this is exactly what the code currently does, as noted in the commit
log: "It's worth mentioning that doing a build before/after this patch
results in no binary output differences.
> Presumably the record should only exist if ucFakeEDIDLength is non 0,
> but I don't know if there are some OEMs out there that just included
> an empty record for some reason. Maybe the code is wrong today and
> there are some OEMs that include it and the array is already size 0.
> In that case, Paulo's original patches are probably more correct.
Right, but if true, that seems to be a distinctly separate bug fix?
--
Kees Cook
next prev parent reply other threads:[~2022-11-01 22:42 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-28 5:41 [PATCH] [next] drm/radeon: Replace one-element array with flexible-array member Paulo Miguel Almeida
2022-10-29 3:32 ` [PATCH v2] " Paulo Miguel Almeida
2022-10-29 4:04 ` Kees Cook
2022-11-01 14:42 ` Alex Deucher
2022-11-01 21:13 ` Paulo Miguel Almeida
2022-11-01 21:27 ` Alex Deucher
2022-11-01 21:54 ` Kees Cook
2022-11-01 22:09 ` Alex Deucher
2022-11-01 22:41 ` Kees Cook [this message]
2022-11-02 16:11 ` Alex Deucher
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202211011538.B7548FDDE@keescook \
--to=keescook@chromium.org \
--cc=Xinhui.Pan@amd.com \
--cc=airlied@gmail.com \
--cc=alexander.deucher@amd.com \
--cc=alexdeucher@gmail.com \
--cc=amd-gfx@lists.freedesktop.org \
--cc=christian.koenig@amd.com \
--cc=daniel@ffwll.ch \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=paulo.miguel.almeida.rodenas@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox