diff options
| author |   Emil Velikov <emil.l.velikov@gmail.com> | 2011-06-11 13:30:32 +0100 |
|---|---|---|
| committer |   Ben Skeggs <bskeggs@redhat.com> | 2011-06-18 14:38:38 +1000 |
| commit | 2905544073f6ec235b44f624c66f52b61221a16c (patch) | |
| tree | 87daa81b07538956e110e84631617be5c1bc5691 /drivers/gpu/drm/nouveau/nouveau_perf.c | |
| parent | drm/nouveau: fix big-endian switch (diff) | |
| download | linux-dev-2905544073f6ec235b44f624c66f52b61221a16c.tar.xz linux-dev-2905544073f6ec235b44f624c66f52b61221a16c.zip | |
drm/nouveau/pm: Prevent overflow in nouveau_perf_init()
While parsing the perf table, there is no check if
the num of entries read from the vbios is less than
the currently allocated number.
In case of a buggy vbios this will cause overwriting
of kernel memory, causing aditional problems.
Add a simple check in order to prevent the case
Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Diffstat (limited to '')
| -rw-r--r-- | drivers/gpu/drm/nouveau/nouveau_perf.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/gpu/drm/nouveau/nouveau_perf.c b/drivers/gpu/drm/nouveau/nouveau_perf.c index 922fb6b664ed..ef9dec0e6f8b 100644 --- a/drivers/gpu/drm/nouveau/nouveau_perf.c +++ b/drivers/gpu/drm/nouveau/nouveau_perf.c @@ -182,6 +182,11 @@ nouveau_perf_init(struct drm_device *dev) entries = perf[2]; } + if (entries > NOUVEAU_PM_MAX_LEVEL) { + NV_DEBUG(dev, "perf table has too many entries - buggy vbios?\n"); + entries = NOUVEAU_PM_MAX_LEVEL; + } + entry = perf + headerlen; for (i = 0; i < entries; i++) { struct nouveau_pm_level *perflvl = &pm->perflvl[pm->nr_perflvl]; |