diff options
| author | Imre Deak <imre.deak@intel.com> | 2016-01-29 15:44:29 +0300 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2016-02-05 08:23:48 +0300 |
| commit | 4d6a10da79fddcf7460299ab390da74ef2b592f6 (patch) | |
| tree | 1a09af919fb8ab10db0d84a0b1440883ee89f913 /drivers/gpu/drm/drm_dp_mst_topology.c | |
| parent | 441388a8a73f905359e60518cfc18eca6aed2b6a (diff) | |
| download | linux-4d6a10da79fddcf7460299ab390da74ef2b592f6.tar.xz | |
drm/mst: Add range check for max_payloads during init
max_payload is limited by the space we have in
drm_dp_mst_topology_mgr::vcpi_mask,payload_mask. We need to track
max_payloads+1 IDs in these masks, see drm_dp_mst_assign_payload_id().
Add a sanity check for this.
Caught by coverity.
Signed-off-by: Imre Deak <imre.deak@intel.com>
Reviewed-by: David Weinehall <david.weinehall@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/drm_dp_mst_topology.c')
| -rw-r--r-- | drivers/gpu/drm/drm_dp_mst_topology.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c index 2b7c2f068834..0680e7aecac4 100644 --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -2848,6 +2848,9 @@ int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr, mgr->max_dpcd_transaction_bytes = max_dpcd_transaction_bytes; mgr->max_payloads = max_payloads; mgr->conn_base_id = conn_base_id; + if (max_payloads + 1 > sizeof(mgr->payload_mask) * 8 || + max_payloads + 1 > sizeof(mgr->vcpi_mask) * 8) + return -EINVAL; mgr->payloads = kcalloc(max_payloads, sizeof(struct drm_dp_payload), GFP_KERNEL); if (!mgr->payloads) return -ENOMEM; |