| Message ID | 20180629214743.1503-1-jcrouse@codeaurora.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Fri, Jun 29, 2018 at 03:47:43PM -0600, Jordan Crouse wrote: > If a encoder name isn't specified for drm_encoder_init() it will try > to construct one based on the incoming encoder_type identifier. If the > caller passes an invalid encoder_type value the lookup could walk right > past the end of the table. > > [v2: Use a WARN() at the top of the function as suggested by Daniel > Vetter] > > Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Aside: Want drm-misc commit rights so you can push patches like these yourself? Might also be useful in case the group maintainership thing with msm happens, just as prep. -Daniel > --- > drivers/gpu/drm/drm_encoder.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/gpu/drm/drm_encoder.c b/drivers/gpu/drm/drm_encoder.c > index 273e1c59c54a..6228c2cee5f0 100644 > --- a/drivers/gpu/drm/drm_encoder.c > +++ b/drivers/gpu/drm/drm_encoder.c > @@ -114,6 +114,10 @@ int drm_encoder_init(struct drm_device *dev, > if (WARN_ON(dev->mode_config.num_encoder >= 32)) > return -EINVAL; > > + /* Make sure that the requested encoder type is in the list */ > + if (WARN_ON(encoder_type >= ARRAY_SIZE(drm_encoder_enum_list))) > + return -EINVAL; > + > ret = drm_mode_object_add(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER); > if (ret) > return ret; > -- > 2.17.1 >
diff --git a/drivers/gpu/drm/drm_encoder.c b/drivers/gpu/drm/drm_encoder.c index 273e1c59c54a..6228c2cee5f0 100644 --- a/drivers/gpu/drm/drm_encoder.c +++ b/drivers/gpu/drm/drm_encoder.c @@ -114,6 +114,10 @@ int drm_encoder_init(struct drm_device *dev, if (WARN_ON(dev->mode_config.num_encoder >= 32)) return -EINVAL; + /* Make sure that the requested encoder type is in the list */ + if (WARN_ON(encoder_type >= ARRAY_SIZE(drm_encoder_enum_list))) + return -EINVAL; + ret = drm_mode_object_add(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER); if (ret) return ret;
If a encoder name isn't specified for drm_encoder_init() it will try to construct one based on the incoming encoder_type identifier. If the caller passes an invalid encoder_type value the lookup could walk right past the end of the table. [v2: Use a WARN() at the top of the function as suggested by Daniel Vetter] Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org> --- drivers/gpu/drm/drm_encoder.c | 4 ++++ 1 file changed, 4 insertions(+)