linux-kernel - Re: [linux-sunxi] [PATCH] drm/sun4i: Fix dsi dcs long write function

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 28 Aug 2020 14:51:24 +0200
From:   Ondřej Jirman <megous@...ous.com>
To:     Jernej Škrabec <jernej.skrabec@...il.com>
Cc:     linux-sunxi@...glegroups.com, Maxime Ripard <mripard@...nel.org>,
        Chen-Yu Tsai <wens@...e.org>, David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        "open list:DRM DRIVERS FOR ALLWINNER A10" 
        <dri-devel@...ts.freedesktop.org>,
        "moderated list:ARM/Allwinner sunXi SoC support" 
        <linux-arm-kernel@...ts.infradead.org>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [linux-sunxi] [PATCH] drm/sun4i: Fix dsi dcs long write function

On Fri, Aug 28, 2020 at 02:35:26PM +0200, Jernej Škrabec wrote:
> Dne petek, 28. avgust 2020 ob 13:24:44 CEST je Ondrej Jirman napisal(a):
> > It's writing too much data. regmap_bulk_write expects number of
> > register sized chunks to write, not a byte sized length of the
> > bounce buffer. Bounce buffer needs to be padded too, so that
> > regmap_bulk_write will not read past the end of the buffer.
> > 
> > Signed-off-by: Ondrej Jirman <megous@...ous.com>
> 
> Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller 
> support")

It doesn't really fix anything user visible though, and will not help
the stable branch in any way. It just makes the code more correct.

Though now that you came up with the tag, copypasting it is not that much
work. ;) So I added it.

> should be added. Fix will be then automatically picked into stable releases.
> 
> Small nit below.
> 
> > ---
> >  drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
> > b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c index 7f13f4d715bf..840fad1b68dd
> > 100644
> > --- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
> > +++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
> > @@ -889,7 +889,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi
> > *dsi, regmap_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(0),
> >  		     sun6i_dsi_dcs_build_pkt_hdr(dsi, msg));
> > 
> > -	bounce = kzalloc(msg->tx_len + sizeof(crc), GFP_KERNEL);
> > +	bounce = kzalloc(msg->tx_len + sizeof(crc) + 3, GFP_KERNEL);
> 
> It would be nicer to use ALIGN() macro, but I'm fine either way.

Nice idea.

> Reviewed-by: Jernej Skrabec <jernej.skrabec@...l.net>

Thanks. :)

regards,
	o.

> Best regards,
> Jernej
> 
> >  	if (!bounce)
> >  		return -ENOMEM;
> > 
> > @@ -900,7 +900,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi
> > *dsi, memcpy((u8 *)bounce + msg->tx_len, &crc, sizeof(crc));
> >  	len += sizeof(crc);
> > 
> > -	regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, 
> len);
> > +	regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce,
> > DIV_ROUND_UP(len, 4)); regmap_write(dsi->regs, SUN6I_DSI_CMD_CTL_REG, len +
> > 4 - 1);
> >  	kfree(bounce);
> 
> 
> 
>