Commit 29055440 authored by Emil Velikov's avatar Emil Velikov Committed by Ben Skeggs

drm/nouveau/pm: Prevent overflow in nouveau_perf_init()

While parsing the perf table, there is no check if
the num of entries read from the vbios is less than
the currently allocated number.

In case of a buggy vbios this will cause overwriting
of kernel memory, causing aditional problems.

Add a simple check in order to prevent the case
Signed-off-by: default avatarEmil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
parent 0897554c
...@@ -182,6 +182,11 @@ nouveau_perf_init(struct drm_device *dev) ...@@ -182,6 +182,11 @@ nouveau_perf_init(struct drm_device *dev)
entries = perf[2]; entries = perf[2];
} }
if (entries > NOUVEAU_PM_MAX_LEVEL) {
NV_DEBUG(dev, "perf table has too many entries - buggy vbios?\n");
entries = NOUVEAU_PM_MAX_LEVEL;
}
entry = perf + headerlen; entry = perf + headerlen;
for (i = 0; i < entries; i++) { for (i = 0; i < entries; i++) {
struct nouveau_pm_level *perflvl = &pm->perflvl[pm->nr_perflvl]; struct nouveau_pm_level *perflvl = &pm->perflvl[pm->nr_perflvl];
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment