Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20220228081421.1504213-1-hsinyi@chromium.org>
In-Reply-To: <20220228081421.1504213-1-hsinyi@chromium.org>
From:   Robert Foss <robert.foss@linaro.org>
Date:   Mon, 28 Feb 2022 16:13:24 +0100
Message-ID: <CAG3jFysyV8QHO4zEdUYLxt9eBnGsHWrXdWbicmufUPnTB-oRLA@mail.gmail.com>
Subject: Re: [PATCH] drm/bridge: it6505: Fix the read buffer array bound
To:     Hsin-Yi Wang <hsinyi@chromium.org>
Cc:     David Airlie <airlied@linux.ie>,
        Allen Chen <allen.chen@ite.com.tw>,
        Neil Armstrong <narmstrong@baylibre.com>,
        Laurent Pinchart <laurent.pinchart@ideasonboard.com>,
        Andrzej Hajda <andrzej.hajda@intel.com>,
        Hermes Wu <Hermes.Wu@ite.com.tw>,
        Daniel Vetter <daniel@ffwll.ch>,
        AngeloGioacchino Del Regno 
        <angelogioacchino.delregno@collabora.com>,
        dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
        Mark Brown <broonie@kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Mon, 28 Feb 2022 at 09:14, Hsin-Yi Wang <hsinyi@chromium.org> wrote:
>
> The size of read_buf is READ_BUFFER_SIZE (200), so we can't access it
> with read_buf + PAGE_SIZE (4096). Extend the READ_BUFFER_SIZE to 400 and
> set the end position to read_buf + READ_BUFFER_SIZE.
>
> Fixes: b5c84a9edcd418 ("drm/bridge: add it6505 driver")
> Reported-by: Mark Brown <broonie@kernel.org>
> Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
> ---
>  drivers/gpu/drm/bridge/ite-it6505.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
> index fb16a176822d81..f2f101220ade94 100644
> --- a/drivers/gpu/drm/bridge/ite-it6505.c
> +++ b/drivers/gpu/drm/bridge/ite-it6505.c
> @@ -289,7 +289,7 @@
>  #define WORD_LENGTH_20BIT 2
>  #define WORD_LENGTH_24BIT 3
>  #define DEBUGFS_DIR_NAME "it6505-debugfs"
> -#define READ_BUFFER_SIZE 200
> +#define READ_BUFFER_SIZE 400
>
>  /* Vendor option */
>  #define HDCP_DESIRED 1
> @@ -3074,7 +3074,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf,
>         struct it6505 *it6505 = file->private_data;
>         struct drm_display_mode *vid = &it6505->video_info;
>         u8 read_buf[READ_BUFFER_SIZE];
> -       u8 *str = read_buf, *end = read_buf + PAGE_SIZE;
> +       u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE;
>         ssize_t ret, count;
>
>         if (!it6505)
> --
> 2.35.1.574.g5d30c73bfb-goog
>

Reviewed-by: Robert Foss <robert.foss@linaro.org>