Commit 1fad33f0 authored by Thomas Zimmermann's avatar Thomas Zimmermann
Browse files

drm/udl: Return error if vendor descriptor is too short 



There need to be least 5 bytes in the vendor descriptor. Return
an error otherwise. Also change the branching to early-out on
the error. Adjust indention of the rest of the parser function.

The original length test expected more than 5 bytes in the vendor
descriptor. As a descriptor with no key-value pairs has exactly 5
bytes and is still valid, change the test to accept this case as
well.

v2
- clarify changes to length test in commit description (Patrik)

Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: default avatarPatrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://lore.kernel.org/r/20250410105948.25463-7-tzimmermann@suse.de
parent 895452ae

drivers/gpu/drm/udl/udl_main.c

+36 −36
Original line number Diff line number Diff line
@@ -45,9 +45,10 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl) 
		goto unrecognized;

	len = ret;



	if (len > 5) {

		DRM_INFO("vendor descriptor length: %u data:%11ph\n",

			 len, desc);

	if (len < 5)

		goto unrecognized;



	DRM_INFO("vendor descriptor length: %u data:%11ph\n", len, desc);



	if ((desc[0] != len) ||    /* descriptor length */

	    (desc[1] != 0x5f) ||   /* vendor descriptor type */
@@ -70,8 +71,8 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl) 


		switch (key) {

		case 0x0200: { /* max_area */

				u32 max_area;

				max_area = le32_to_cpu(*((u32 *)desc));

			u32 max_area = le32_to_cpu(*((u32 *)desc));



			DRM_DEBUG("DL chip limited to %d pixel modes\n",

				  max_area);

			udl->sku_pixel_limit = max_area;
@@ -82,7 +83,6 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl) 
		}

		desc += length;

	}

	}



	goto success;