diff options
| author | Alex Deucher <alexander.deucher@amd.com> | 2016-08-24 12:31:36 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-09-07 08:34:50 +0200 |
| commit | 0b24e675dc73ad099447b8e32a3a0eb444abf596 (patch) | |
| tree | 6a3bd51f4faa4d395957e9c0ea3a801a70c4bc2f /drivers | |
| parent | 7715b24f7da6bbdd2f7bc27fcfb79299525d7927 (diff) | |
| download | lwn-0b24e675dc73ad099447b8e32a3a0eb444abf596.tar.gz lwn-0b24e675dc73ad099447b8e32a3a0eb444abf596.zip | |
drm/amdgpu: avoid a possible array overflow
commit e1718d97aa88ea44a6a8f50ff464253dd0dacf01 upstream.
When looking up the connector type make sure the index
is valid. Avoids a later crash if we read past the end
of the array.
Workaround for bug:
https://bugs.freedesktop.org/show_bug.cgi?id=97460
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c index 983175363b06..151422307d31 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c @@ -321,6 +321,12 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device * (le16_to_cpu(path->usConnObjectId) & OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT; + if (con_obj_id >= ARRAY_SIZE(object_connector_convert)) { + DRM_ERROR("invalid con_obj_id %d for device tag 0x%04x\n", + con_obj_id, le16_to_cpu(path->usDeviceTag)); + continue; + } + connector_type = object_connector_convert[con_obj_id]; connector_object_id = con_obj_id; |