From 5ebbb5b4d424e030b7d240ce71767c4145c7f26e Mon Sep 17 00:00:00 2001 From: =?utf8?q?Ville=20Syrj=C3=A4l=C3=A4?= Date: Fri, 2 Mar 2018 16:03:00 +0200 Subject: [PATCH] drm: Check property/enum name length MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Reject requests to add properties/enums with an overly long name. Previously we would have just silently truncated the string and exposed it userspace. v2: drm_property_create() returns a pointer Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20180302140300.31110-1-ville.syrjala@linux.intel.com Reviewed-by: Daniel Vetter --- drivers/gpu/drm/drm_property.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c index fe8627fb7ae6..c37ac41125b5 100644 --- a/drivers/gpu/drm/drm_property.c +++ b/drivers/gpu/drm/drm_property.c @@ -78,6 +78,9 @@ struct drm_property *drm_property_create(struct drm_device *dev, int flags, struct drm_property *property = NULL; int ret; + if (WARN_ON(strlen(name) >= DRM_PROP_NAME_LEN)) + return NULL; + property = kzalloc(sizeof(struct drm_property), GFP_KERNEL); if (!property) return NULL; @@ -372,6 +375,9 @@ int drm_property_add_enum(struct drm_property *property, int index, { struct drm_property_enum *prop_enum; + if (WARN_ON(strlen(name) >= DRM_PROP_NAME_LEN)) + return -EINVAL; + if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) || drm_property_type_is(property, DRM_MODE_PROP_BITMASK))) return -EINVAL; -- 2.30.2