Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d81a67cc authored by Imre Deak's avatar Imre Deak
Browse files

drm/i915: Sanity check DP AUX message buffer and size 



While we are calling intel_dp_aux_transfer() with msg->size=0 whenever
msg->buffer is NULL, passing NULL to memcpy() is undefined according to
the ISO C standard. I haven't found any notes about this in the GNU C's
or the kernel's documentation of the function and can't imagine what it
would do with the NULL ptr. To better document this use of the
parameters it still make sense to add an explicit check for this to the
code.

Signed-off-by: default avatarImre Deak <imre.deak@intel.com>
Reviewed-by: default avatarDavid Weinehall <david.weinehall@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1454071949-24677-1-git-send-email-imre.deak@intel.com
parent 985dd436

drivers/gpu/drm/i915/intel_dp.c

+4 −1
Original line number Diff line number Diff line
@@ -979,7 +979,10 @@ intel_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg) 
		if (WARN_ON(txsize > 20))

			return -E2BIG;



		if (msg->buffer)

			memcpy(txbuf + HEADER_SIZE, msg->buffer, msg->size);

		else

			WARN_ON(msg->size);



		ret = intel_dp_aux_ch(intel_dp, txbuf, txsize, rxbuf, rxsize);

		if (ret > 0) {