diff options
author | Álvaro Fernández Rojas <noltari@gmail.com> | 2020-03-23 08:48:08 +0100 |
---|---|---|
committer | Álvaro Fernández Rojas <noltari@gmail.com> | 2020-03-23 08:48:08 +0100 |
commit | 6c9b5d6972aa84b85aa9d5d95b3e01f23525e929 (patch) | |
tree | 47f488bbfe8a0973955c34df627a30d81d7c8046 /target/linux/bcm27xx/patches-5.4/950-0480-drm-modes-parse_cmdline-Fix-possible-reference-past-.patch | |
parent | 835d1c68a0f036c8b0d837a48b5a05fdfb2e8218 (diff) | |
download | upstream-6c9b5d6972aa84b85aa9d5d95b3e01f23525e929.tar.gz upstream-6c9b5d6972aa84b85aa9d5d95b3e01f23525e929.tar.bz2 upstream-6c9b5d6972aa84b85aa9d5d95b3e01f23525e929.zip |
bcm27xx: sync 5.4 patches with RPi Foundation
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Diffstat (limited to 'target/linux/bcm27xx/patches-5.4/950-0480-drm-modes-parse_cmdline-Fix-possible-reference-past-.patch')
-rw-r--r-- | target/linux/bcm27xx/patches-5.4/950-0480-drm-modes-parse_cmdline-Fix-possible-reference-past-.patch | 141 |
1 files changed, 141 insertions, 0 deletions
diff --git a/target/linux/bcm27xx/patches-5.4/950-0480-drm-modes-parse_cmdline-Fix-possible-reference-past-.patch b/target/linux/bcm27xx/patches-5.4/950-0480-drm-modes-parse_cmdline-Fix-possible-reference-past-.patch new file mode 100644 index 0000000000..1617a45d52 --- /dev/null +++ b/target/linux/bcm27xx/patches-5.4/950-0480-drm-modes-parse_cmdline-Fix-possible-reference-past-.patch @@ -0,0 +1,141 @@ +From fade8b3cf37785297b4f8a9bbd13ab107208af5a Mon Sep 17 00:00:00 2001 +From: Hans de Goede <hdegoede@redhat.com> +Date: Mon, 18 Nov 2019 16:51:22 +0100 +Subject: [PATCH] drm/modes: parse_cmdline: Fix possible reference past + end of string + +Commit 8582e244e5fe72d2e9ace186fa8f3ed3bb4122e1 upstream. + +Before this commit, if the last option of a video=... option is for +example "rotate" without a "=<value>" after it then delim will point to +the terminating 0 of the string, and value which is sets to <delim + 1> +will point one position past the end of the string. + +This commit fixes this by enforcing that the contents of delim equals '=' +as it should be for options which take a value, this check is done in a +new drm_mode_parse_cmdline_int helper function which factors out the +common integer parsing code for all the options which take an int. + +Acked-by: Maxime Ripard <mripard@kernel.org> +Signed-off-by: Hans de Goede <hdegoede@redhat.com> +Link: https://patchwork.freedesktop.org/patch/msgid/20191118155134.30468-1-hdegoede@redhat.com +--- + drivers/gpu/drm/drm_modes.c | 68 ++++++++++++++++--------------------- + 1 file changed, 30 insertions(+), 38 deletions(-) + +--- a/drivers/gpu/drm/drm_modes.c ++++ b/drivers/gpu/drm/drm_modes.c +@@ -1568,11 +1568,34 @@ static int drm_mode_parse_cmdline_res_mo + return 0; + } + ++static int drm_mode_parse_cmdline_int(const char *delim, unsigned int *int_ret) ++{ ++ const char *value; ++ char *endp; ++ ++ /* ++ * delim must point to the '=', otherwise it is a syntax error and ++ * if delim points to the terminating zero, then delim + 1 wil point ++ * past the end of the string. ++ */ ++ if (*delim != '=') ++ return -EINVAL; ++ ++ value = delim + 1; ++ *int_ret = simple_strtol(value, &endp, 10); ++ ++ /* Make sure we have parsed something */ ++ if (endp == value) ++ return -EINVAL; ++ ++ return 0; ++} ++ + static int drm_mode_parse_cmdline_options(char *str, size_t len, + const struct drm_connector *connector, + struct drm_cmdline_mode *mode) + { +- unsigned int rotation = 0; ++ unsigned int deg, margin, rotation = 0; + char *sep = str; + + while ((sep = strchr(sep, ','))) { +@@ -1588,13 +1611,7 @@ static int drm_mode_parse_cmdline_option + } + + if (!strncmp(option, "rotate", delim - option)) { +- const char *value = delim + 1; +- unsigned int deg; +- +- deg = simple_strtol(value, &sep, 10); +- +- /* Make sure we have parsed something */ +- if (sep == value) ++ if (drm_mode_parse_cmdline_int(delim, °)) + return -EINVAL; + + switch (deg) { +@@ -1619,57 +1636,32 @@ static int drm_mode_parse_cmdline_option + } + } else if (!strncmp(option, "reflect_x", delim - option)) { + rotation |= DRM_MODE_REFLECT_X; +- sep = delim; + } else if (!strncmp(option, "reflect_y", delim - option)) { + rotation |= DRM_MODE_REFLECT_Y; +- sep = delim; + } else if (!strncmp(option, "margin_right", delim - option)) { +- const char *value = delim + 1; +- unsigned int margin; +- +- margin = simple_strtol(value, &sep, 10); +- +- /* Make sure we have parsed something */ +- if (sep == value) ++ if (drm_mode_parse_cmdline_int(delim, &margin)) + return -EINVAL; + + mode->tv_margins.right = margin; + } else if (!strncmp(option, "margin_left", delim - option)) { +- const char *value = delim + 1; +- unsigned int margin; +- +- margin = simple_strtol(value, &sep, 10); +- +- /* Make sure we have parsed something */ +- if (sep == value) ++ if (drm_mode_parse_cmdline_int(delim, &margin)) + return -EINVAL; + + mode->tv_margins.left = margin; + } else if (!strncmp(option, "margin_top", delim - option)) { +- const char *value = delim + 1; +- unsigned int margin; +- +- margin = simple_strtol(value, &sep, 10); +- +- /* Make sure we have parsed something */ +- if (sep == value) ++ if (drm_mode_parse_cmdline_int(delim, &margin)) + return -EINVAL; + + mode->tv_margins.top = margin; + } else if (!strncmp(option, "margin_bottom", delim - option)) { +- const char *value = delim + 1; +- unsigned int margin; +- +- margin = simple_strtol(value, &sep, 10); +- +- /* Make sure we have parsed something */ +- if (sep == value) ++ if (drm_mode_parse_cmdline_int(delim, &margin)) + return -EINVAL; + + mode->tv_margins.bottom = margin; + } else { + return -EINVAL; + } ++ sep = delim; + } + + mode->rotation_reflection = rotation; |