[PATCH 1/8] drm/edid: Check the number of detailed timing descriptors in the CEA ext block

[Shankar, Uma]

> -----Original Message-----
> From: dri-devel <dri-devel-bounces at lists.freedesktop.org> On Behalf Of Alex
> Deucher
> Sent: Tuesday, January 28, 2020 4:04 AM
> To: Ville Syrjala <ville.syrjala at linux.intel.com>
> Cc: Allen Chen <allen.chen at ite.com.tw>; Intel Graphics Development <intel-
> gfx at lists.freedesktop.org>; Maling list - DRI developers <dri-
> devel at lists.freedesktop.org>
> Subject: Re: [PATCH 1/8] drm/edid: Check the number of detailed timing descriptors
> in the CEA ext block
> 
> On Fri, Jan 24, 2020 at 3:03 PM Ville Syrjala <ville.syrjala at linux.intel.com> wrote:
> >
> > From: Ville Syrjälä <ville.syrjala at linux.intel.com>
> >
> > CEA-861 says :
> > "d = offset for the byte following the reserved data block.
> >  If no data is provided in the reserved data block, then d=4.
> >  If no DTDs are provided, then d=0."
> >
> > So let's not look for DTDs when d==0. In fact let's just make that
> > <4 since those values would just mean that he DTDs overlap the block
> > header. And let's also check that d isn't so big as to declare the
> > descriptors to live past the block end, although the code does already
> > survive that case as we'd just end up with a negative number of
> > descriptors and the loop would not do anything.
> >
> > Cc: Allen Chen <allen.chen at ite.com.tw>
> > Signed-off-by: Ville Syrjälä <ville.syrjala at linux.intel.com>
> 
> Acked-by: Alex Deucher <alexander.deucher at amd.com>

Looks good to me as well.
Reviewed-by: Uma Shankar <uma.shankar at intel.com>

> > ---
> >  drivers/gpu/drm/drm_edid.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
> > index 99769d6c9f84..1b6e544cf5c7 100644
> > --- a/drivers/gpu/drm/drm_edid.c
> > +++ b/drivers/gpu/drm/drm_edid.c
> > @@ -2201,10 +2201,13 @@ typedef void detailed_cb(struct
> > detailed_timing *timing, void *closure);  static void
> >  cea_for_each_detailed_block(u8 *ext, detailed_cb *cb, void *closure)
> > {
> > -       int i, n = 0;
> > +       int i, n;
> >         u8 d = ext[0x02];
> >         u8 *det_base = ext + d;
> >
> > +       if (d < 4 || d > 127)
> > +               return;
> > +
> >         n = (127 - d) / 18;
> >         for (i = 0; i < n; i++)
> >                 cb((struct detailed_timing *)(det_base + 18 * i),
> > closure);
> > --
> > 2.24.1
> >
> > _______________________________________________
> > dri-devel mailing list
> > dri-devel at lists.freedesktop.org
> > https://lists.freedesktop.org/mailman/listinfo/dri-devel
> _______________________________________________
> dri-devel mailing list
> dri-devel at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel