diff options
| author | Hsin-Yi Wang <hsinyi@chromium.org> | 2022-02-28 16:14:21 +0800 |
|---|---|---|
| committer | Robert Foss <robert.foss@linaro.org> | 2022-02-28 16:10:13 +0100 |
| commit | e22dfdb63df36427067fad6b9bfdc8c08371ab38 (patch) | |
| tree | 951006d944b35447f3236e5cb79153b403430884 | |
| parent | f85b3f806e4d43a0e3e5c042f40b7fe5faf2f6cf (diff) | |
| download | linux-stable-e22dfdb63df36427067fad6b9bfdc8c08371ab38.tar.gz linux-stable-e22dfdb63df36427067fad6b9bfdc8c08371ab38.tar.bz2 linux-stable-e22dfdb63df36427067fad6b9bfdc8c08371ab38.zip | |
drm/bridge: it6505: Fix the read buffer array bound
The size of read_buf is READ_BUFFER_SIZE (200), so we can't access it
with read_buf + PAGE_SIZE (4096). Extend the READ_BUFFER_SIZE to 400 and
set the end position to read_buf + READ_BUFFER_SIZE.
Fixes: b5c84a9edcd418 ("drm/bridge: add it6505 driver")
Reported-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20220228081421.1504213-1-hsinyi@chromium.org
| -rw-r--r-- | drivers/gpu/drm/bridge/ite-it6505.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c index fb16a176822d..f2f101220ade 100644 --- a/drivers/gpu/drm/bridge/ite-it6505.c +++ b/drivers/gpu/drm/bridge/ite-it6505.c @@ -289,7 +289,7 @@ #define WORD_LENGTH_20BIT 2 #define WORD_LENGTH_24BIT 3 #define DEBUGFS_DIR_NAME "it6505-debugfs" -#define READ_BUFFER_SIZE 200 +#define READ_BUFFER_SIZE 400 /* Vendor option */ #define HDCP_DESIRED 1 @@ -3074,7 +3074,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf, struct it6505 *it6505 = file->private_data; struct drm_display_mode *vid = &it6505->video_info; u8 read_buf[READ_BUFFER_SIZE]; - u8 *str = read_buf, *end = read_buf + PAGE_SIZE; + u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE; ssize_t ret, count; if (!it6505) |