On Wed, Oct 14, 2015 at 04:07:20PM +1000, Dave Airlie wrote: > From: Dave Airlie <airlied@xxxxxxxxxx> > > This avoids some of the fields being random garbage. > > found this while debugging some other pain. > > Cc: stable@xxxxxxxxxxxxxxx > Signed-off-by: Dave Airlie <airlied@xxxxxxxxxx> Sligthly more serious is that we have a hardcoded limit on the number of i2c transactions we accept of 4 and we never check that anywhere. And that's supplied by userspace through i2c-dev nodes potentially and a few lines below we just loop over that array. Ofc the mst_i2c_xfer isn't really compliant in general since it doesn't process any kind of i2c transactions but only those that drm_edid feeds it (more or less). But that's another topic, but checking num < 4 is an easy buffer overflow. With that addressed too this is Reviewed-by: Daniel Vetter <daniel.vetter@xxxxxxxx> Cheers, Daniel > --- > drivers/gpu/drm/drm_dp_mst_topology.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c > index ac3c273..2e4f8a3 100644 > --- a/drivers/gpu/drm/drm_dp_mst_topology.c > +++ b/drivers/gpu/drm/drm_dp_mst_topology.c > @@ -2627,6 +2627,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs > goto out; > } > > + memset(&msg, 0, sizeof(msg)); > msg.req_type = DP_REMOTE_I2C_READ; > msg.u.i2c_read.num_transactions = num - 1; > msg.u.i2c_read.port_number = port->port_num; > -- > 2.4.3 > > _______________________________________________ > dri-devel mailing list > dri-devel@xxxxxxxxxxxxxxxxxxxxx > http://lists.freedesktop.org/mailman/listinfo/dri-devel -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx http://lists.freedesktop.org/mailman/listinfo/dri-devel
