lab.nexedi.com will be down from Thursday, 20 March 2025, 07:30:00 UTC for a duration of approximately 2 hours

Commit b479efb0 authored by Huang Rui's avatar Huang Rui Committed by Alex Deucher

drm/amd/display: fix the system memory page fault because of copy overflow

The buffer is allocated with the size of pointer and copy with the size of
data structure. Then trigger the system memory page fault. Use the
orignal data structure to get the object size.

Fixes: 3a00c042 ("drm/amd/display/dc/core/dc_link: Move some local data from the stack to the heap")
Signed-off-by: default avatarHuang Rui <ray.huang@amd.com>
Cc: Lee Jones <lee.jones@linaro.org>
Reviewed-by: default avatarJinzhou.Su <Jinzhou.Su@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 3f5f1889
...@@ -1380,7 +1380,7 @@ static bool dc_link_construct(struct dc_link *link, ...@@ -1380,7 +1380,7 @@ static bool dc_link_construct(struct dc_link *link,
DC_LOGGER_INIT(dc_ctx->logger); DC_LOGGER_INIT(dc_ctx->logger);
info = kzalloc(sizeof(info), GFP_KERNEL); info = kzalloc(sizeof(struct integrated_info), GFP_KERNEL);
if (!info) if (!info)
goto create_fail; goto create_fail;
...@@ -1545,7 +1545,7 @@ static bool dc_link_construct(struct dc_link *link, ...@@ -1545,7 +1545,7 @@ static bool dc_link_construct(struct dc_link *link,
} }
if (bios->integrated_info) if (bios->integrated_info)
memcpy(info, bios->integrated_info, sizeof(*info)); memcpy(info, bios->integrated_info, sizeof(struct integrated_info));
/* Look for channel mapping corresponding to connector and device tag */ /* Look for channel mapping corresponding to connector and device tag */
for (i = 0; i < MAX_NUMBER_OF_EXT_DISPLAY_PATH; i++) { for (i = 0; i < MAX_NUMBER_OF_EXT_DISPLAY_PATH; i++) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment