On Fri, 13 Sep 2013, Paulo Zanoni <przanoni@xxxxxxxxx> wrote:
> From: Paulo Zanoni <paulo.r.zanoni@xxxxxxxxx>
>
> So far we control all the reads an none of them exceeds the current
> limit of 20 bytes, but we never think about this when reviewing
> patches, so we may at some point in the future overflow the buffer.
>
> My initial patch just added a WARN in case we were about to overflow
> the buffer, but Chris suggested to make the size of the array dynamic.
VLA on stack in kernel gives me an uneasy feeling, but I'll survive.
intel_dp_aux_native_write() has a range check and an error return for
this. Maybe make the same change there, and add a
BUG_ON({send,recv}_bytes > 0x100) to both, since that's the max?
Jani.
> Signed-off-by: Paulo Zanoni <paulo.r.zanoni@xxxxxxxxx>
> ---
> drivers/gpu/drm/i915/intel_dp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
> index 20e468c..bf0b260 100644
> --- a/drivers/gpu/drm/i915/intel_dp.c
> +++ b/drivers/gpu/drm/i915/intel_dp.c
> @@ -564,7 +564,7 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp,
> {
> uint8_t msg[4];
> int msg_bytes;
> - uint8_t reply[20];
> + uint8_t reply[recv_bytes + 1];
> int reply_bytes;
> uint8_t ack;
> int ret;
> --
> 1.8.3.1
>
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx
--
Jani Nikula, Intel Open Source Technology Center
_______________________________________________
Intel-gfx mailing list
Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/intel-gfx
