mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-21 10:01:00 +00:00
drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_generic_write_seq()
[ Upstream commit24acbcce5c
] The mipi_dsi_generic_write_seq() macro makes a call to mipi_dsi_generic_write() which returns a type ssize_t. The macro then stores it in an int and checks to see if it's negative. This could theoretically be a problem if "ssize_t" is larger than "int". To see the issue, imagine that "ssize_t" is 32-bits and "int" is 16-bits, you could see a problem if there was some code out there that looked like: mipi_dsi_generic_write_seq(dsi, <32768 bytes as arguments>); ...since we'd get back that 32768 bytes were transferred and 32768 stored in a 16-bit int would look negative. Though there are no callsites where we'd actually hit this (even if "int" was only 16-bit), it's cleaner to make the types match so let's fix it. Fixes:a9015ce593
("drm/mipi-dsi: Add a mipi_dsi_dcs_write_seq() macro") Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://lore.kernel.org/r/20240514102056.v5.2.Iadb65b8add19ed3ae3ed6425011beb97e380a912@changeid Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240514102056.v5.2.Iadb65b8add19ed3ae3ed6425011beb97e380a912@changeid Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
4e9d95a132
commit
8d869d02a1
1 changed files with 11 additions and 11 deletions
|
@ -305,17 +305,17 @@ int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi,
|
|||
* @dsi: DSI peripheral device
|
||||
* @seq: buffer containing the payload
|
||||
*/
|
||||
#define mipi_dsi_generic_write_seq(dsi, seq...) \
|
||||
do { \
|
||||
static const u8 d[] = { seq }; \
|
||||
struct device *dev = &dsi->dev; \
|
||||
int ret; \
|
||||
ret = mipi_dsi_generic_write(dsi, d, ARRAY_SIZE(d)); \
|
||||
if (ret < 0) { \
|
||||
dev_err_ratelimited(dev, "transmit data failed: %d\n", \
|
||||
ret); \
|
||||
return ret; \
|
||||
} \
|
||||
#define mipi_dsi_generic_write_seq(dsi, seq...) \
|
||||
do { \
|
||||
static const u8 d[] = { seq }; \
|
||||
struct device *dev = &dsi->dev; \
|
||||
ssize_t ret; \
|
||||
ret = mipi_dsi_generic_write(dsi, d, ARRAY_SIZE(d)); \
|
||||
if (ret < 0) { \
|
||||
dev_err_ratelimited(dev, "transmit data failed: %zd\n", \
|
||||
ret); \
|
||||
return ret; \
|
||||
} \
|
||||
} while (0)
|
||||
|
||||
/**
|
||||
|
|
Loading…
Reference in a new issue