Re: [PATCH v1 RFC] video/hdmi: Fix HDMI_VENDOR_INFOFRAME_SIZE
From: Jani Nikula <jani.nikula@linux.intel.com>
Date: 2023-01-10 18:24:18
Also in:
dri-devel, lkml
On Mon, 09 Jan 2023, Martin Blumenstingl [off-list ref] wrote:
When support for the HDMI vendor infoframe was introduced back with
commit 7d27becb3532 ("video/hdmi: Introduce helpers for the HDMI vendor
specific infoframe") it's payload size was either 5 or 6 bytes,
depending on:
if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF)
When true the size was 6 bytes, otherwise 5 bytes.
Drivers that are using hdmi_infoframe_pack() are reserving 10 bytes (4
bytes for the header and up to 6 bytes for the infoframe payload data)
or more (exynos_hdmi reserves 25 bytes).
Over time the frame payload length was reduced to 4 bytes. This however
does not match the code from hdmi_hdmi_infoframe_pack() where ptr[8] and
ptr[9] are written, which means the infoframe has to allow up to 6 bytes
of payload data (considering that the header takes 4 bytes).
Change HDMI_VENDOR_INFOFRAME_SIZE to 6 bytes so
hdmi_vendor_infoframe_pack_only() can properly check the passed buffer
size and avoid an out of bounds write to ptr[8] or ptr[9].
Fixes: c5e69ab35c0d ("video/hdmi: Constify infoframe passed to the pack functions")
Fixes: d43be2554b58 ("drivers: video: hdmi: cleanup coding style in video a bit")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
---
I'm not an expert on this topic and I'm not sure if the size still
depends on that if condition from long time ago. So please share your
thoughts.I tried to look at this quickly, but it makes my brain hurt. I don't think simply changing the size here is right either. Cc: Ville. BR, Jani.
quoted hunk ↗ jump to hunk
include/linux/hdmi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/include/linux/hdmi.h b/include/linux/hdmi.h index 2f4dcc8d060e..026c5ef5a1a5 100644 --- a/include/linux/hdmi.h +++ b/include/linux/hdmi.h@@ -57,7 +57,7 @@ enum hdmi_infoframe_type { #define HDMI_SPD_INFOFRAME_SIZE 25 #define HDMI_AUDIO_INFOFRAME_SIZE 10 #define HDMI_DRM_INFOFRAME_SIZE 26 -#define HDMI_VENDOR_INFOFRAME_SIZE 4 +#define HDMI_VENDOR_INFOFRAME_SIZE 6 #define HDMI_INFOFRAME_SIZE(type) \ (HDMI_INFOFRAME_HEADER_SIZE + HDMI_ ## type ## _INFOFRAME_SIZE)
-- Jani Nikula, Intel Open Source Graphics Center