leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

drm/bridge: it6505: Fix the read buffer array bound

Browse Source 
The size of read_buf is READ_BUFFER_SIZE (200), so we can't access it
with read_buf + PAGE_SIZE (4096). Extend the READ_BUFFER_SIZE to 400 and
set the end position to read_buf + READ_BUFFER_SIZE.

Fixes: b5c84a9edc ("drm/bridge: add it6505 driver")
Reported-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20220228081421.1504213-1-hsinyi@chromium.org
This commit is contained in:
Hsin-Yi Wang 2022-02-28 16:14:21 +08:00 committed by Robert Foss
parent f85b3f806e
commit e22dfdb63d
No known key found for this signature in database
GPG Key ID: 3EFD900F76D1D784
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/gpu/drm/bridge/ite-it6505.c
View File

@ -289,7 +289,7 @@
#define WORD_LENGTH_20BIT 2
#define WORD_LENGTH_24BIT 3
#define DEBUGFS_DIR_NAME "it6505-debugfs"
#define READ_BUFFER_SIZE 200
#define READ_BUFFER_SIZE 400
/* Vendor option */
#define HDCP_DESIRED 1
@ -3074,7 +3074,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf,
struct it6505 *it6505 = file->private_data;
struct drm_display_mode *vid = &it6505->video_info;
u8 read_buf[READ_BUFFER_SIZE];
u8 *str = read_buf, *end = read_buf + PAGE_SIZE;
u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE;
ssize_t ret, count;
if (!it6505)