Skip to contentSkip to conversation

drm/dp/mst: zero out i2c read msg before sending

PATCH In review Dave Airlie 2 participants 2 messages Oct 14, 2015

Subsystems (2)
DRM drivers DRM misc
lore
Share & tools
lore

Dave Airlie

author maintainer
#0 lore raw

PATCH 1/1 drm/dp/mst: zero out i2c read msg before sending

From: Dave Airlie <[email protected]>

This avoids some of the fields being random garbage.

found this while debugging some other pain.

Cc [email protected]
Signed-off-by Dave Airlie <[email protected]>
---
 drivers/gpu/drm/drm_dp_mst_topology.c | 1 +
 1 file changed, 1 insertion(+)
drivers/gpu/drm/drm_dp_mst_topology.c +1 -0
index ac3c273..2e4f8a3 100644
@@ -2627,6 +2627,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs
 		goto out;
 	}
 
+	memset(&msg, 0, sizeof(msg));
 	msg.req_type = DP_REMOTE_I2C_READ;
 	msg.u.i2c_read.num_transactions = num - 1;
 	msg.u.i2c_read.port_number = port->port_num;
Signature · 6 lines
2.4.3

_______________________________________________
dri-devel mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/dri-devel
#1 lore raw
Quoted 8 lines · Dave Airlie

From: Dave Airlie <[email protected]>

This avoids some of the fields being random garbage.

found this while debugging some other pain.

Cc [email protected]
Signed-off-by Dave Airlie <[email protected]>

Sligthly more serious is that we have a hardcoded limit on the number of i2c transactions we accept of 4 and we never check that anywhere. And that's supplied by userspace through i2c-dev nodes potentially and a few lines below we just loop over that array.

Ofc the mst_i2c_xfer isn't really compliant in general since it doesn't process any kind of i2c transactions but only those that drm_edid feeds it (more or less). But that's another topic, but checking num < 4 is an easy buffer overflow.

With that addressed too this is Reviewed-by: Daniel Vetter <[email protected]>

Cheers, Daniel

Quoted 23 lines
---
 drivers/gpu/drm/drm_dp_mst_topology.c | 1 +
 1 file changed, 1 insertion(+)
drivers/gpu/drm/drm_dp_mst_topology.c +1 -0
index ac3c273..2e4f8a3 100644
@@ -2627,6 +2627,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs
 		goto out;
 	}
 
+	memset(&msg, 0, sizeof(msg));
 	msg.req_type = DP_REMOTE_I2C_READ;
 	msg.u.i2c_read.num_transactions = num - 1;
 	msg.u.i2c_read.port_number = port->port_num;
Signature · 6 lines
2.4.3

_______________________________________________
dri-devel mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/dri-devel
Signature · 7 lines
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/dri-devel