From: Ville Syrjälä <ville.syrj...@linux.intel.com>

Reject requests to add properties/enums with an overly long name.
Previously we would have just silently truncated the string and exposed
it userspace.

v2: drm_property_create() returns a pointer

Signed-off-by: Ville Syrjälä <ville.syrj...@linux.intel.com>
---
 drivers/gpu/drm/drm_property.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
index fe8627fb7ae6..c37ac41125b5 100644
--- a/drivers/gpu/drm/drm_property.c
+++ b/drivers/gpu/drm/drm_property.c
@@ -78,6 +78,9 @@ struct drm_property *drm_property_create(struct drm_device 
*dev, int flags,
        struct drm_property *property = NULL;
        int ret;
 
+       if (WARN_ON(strlen(name) >= DRM_PROP_NAME_LEN))
+               return NULL;
+
        property = kzalloc(sizeof(struct drm_property), GFP_KERNEL);
        if (!property)
                return NULL;
@@ -372,6 +375,9 @@ int drm_property_add_enum(struct drm_property *property, 
int index,
 {
        struct drm_property_enum *prop_enum;
 
+       if (WARN_ON(strlen(name) >= DRM_PROP_NAME_LEN))
+               return -EINVAL;
+
        if (!(drm_property_type_is(property, DRM_MODE_PROP_ENUM) ||
                        drm_property_type_is(property, DRM_MODE_PROP_BITMASK)))
                return -EINVAL;
-- 
2.16.1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Reply via email to