evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

drm/nouveau: fix i2ctable bounds checking

Browse source 
i2c_entries seems to be the number of i2c entries,
so with index equal to this number, we could read
invalid data from i2ctable. Fix it.

Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This commit is contained in:
Marcin Slusarz 2010-02-15 23:24:49 +01:00 • committed by Ben Skeggs
parent b762b8ce53
commit 761c5a6975
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
drivers/gpu/drm/nouveau/nouveau_bios.c
View file

@ -4984,7 +4984,8 @@ read_dcb_i2c_entry(struct drm_device *dev, int dcb_version, uint8_t *i2ctable, i
else else
NV_WARN(dev, NV_WARN(dev,
"DCB I2C table has more entries than indexable " "DCB I2C table has more entries than indexable "
"(%d entries, max index 15)\n", i2ctable[2]); "(%d entries, max %d)\n", i2ctable[2],
DCB_MAX_NUM_I2C_ENTRIES);
entry_len = i2ctable[3]; entry_len = i2ctable[3];
/* [4] is i2c_default_indices, read in parse_dcb_table() */ /* [4] is i2c_default_indices, read in parse_dcb_table() */
} }
@ -5000,8 +5001,8 @@ read_dcb_i2c_entry(struct drm_device *dev, int dcb_version, uint8_t *i2ctable, i
if (index == 0xf) if (index == 0xf)
return 0; return 0;
if (index > i2c_entries) { if (index >= i2c_entries) {
NV_ERROR(dev, "DCB I2C index too big (%d > %d)\n", NV_ERROR(dev, "DCB I2C index too big (%d >= %d)\n",
index, i2ctable[2]); index, i2ctable[2]);
return -ENOENT; return -ENOENT;
} }