On Wed, Oct 14, 2015 at 04:07:20PM +1000, Dave Airlie wrote:

From: Dave Airlie airlied@redhat.com

This avoids some of the fields being random garbage.

found this while debugging some other pain.

Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie airlied@redhat.com

Sligthly more serious is that we have a hardcoded limit on the number of i2c transactions we accept of 4 and we never check that anywhere. And that's supplied by userspace through i2c-dev nodes potentially and a few lines below we just loop over that array.

Ofc the mst_i2c_xfer isn't really compliant in general since it doesn't process any kind of i2c transactions but only those that drm_edid feeds it (more or less). But that's another topic, but checking num < 4 is an easy buffer overflow.

With that addressed too this is Reviewed-by: Daniel Vetter daniel.vetter@ffwll.ch

Cheers, Daniel

---

drivers/gpu/drm/drm_dp_mst_topology.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c index ac3c273..2e4f8a3 100644 --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -2627,6 +2627,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs goto out; }

• memset(&msg, 0, sizeof(msg)); msg.req_type = DP_REMOTE_I2C_READ; msg.u.i2c_read.num_transactions = num - 1; msg.u.i2c_read.port_number = port->port_num;

-- 2.4.3

---

dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel