diff options
| author |   Mikhail Kobuk <m.kobuk@ispras.ru> | 2024-04-11 14:08:52 +0300 |
|---|---|---|
| committer |   Danilo Krummrich <dakr@redhat.com> | 2024-04-15 10:54:13 +0200 |
| commit | cf92bb778eda7830e79452c6917efa8474a30c1e (patch) | |
| tree | efd25189b895555b7e38c2102da59d52db12e4ba /rust/kernel/ssh:/git@git.zx2c4.com | |
| parent | nouveau: fix instmem race condition around ptr stores (diff) | |
drm: nv04: Fix out of bounds access
When Output Resource (dcb->or) value is assigned in
fabricate_dcb_output(), there may be out of bounds access to
dac_users array in case dcb->or is zero because ffs(dcb->or) is
used as index there.
The 'or' argument of fabricate_dcb_output() must be interpreted as a
number of bit to set, not value.
Utilize macros from 'enum nouveau_or' in calls instead of hardcoding.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 2e5702aff395 ("drm/nouveau: fabricate DCB encoder table for iMac G4")
Fixes: 670820c0e6a9 ("drm/nouveau: Workaround incorrect DCB entry on a GeForce3 Ti 200.")
Signed-off-by: Mikhail Kobuk <m.kobuk@ispras.ru>
Signed-off-by: Danilo Krummrich <dakr@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240411110854.16701-1-m.kobuk@ispras.ru
Diffstat (limited to 'rust/kernel/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions