summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEmil Velikov <emil.l.velikov@gmail.com>2011-06-11 13:30:32 +0100
committerBen Skeggs <bskeggs@redhat.com>2011-06-18 14:38:38 +1000
commit2905544073f6ec235b44f624c66f52b61221a16c (patch)
tree87daa81b07538956e110e84631617be5c1bc5691
parent0897554cdd9de8a9f6f93d9ba27c7ebfae286158 (diff)
downloadkernel-uprobes-2905544073f6ec235b44f624c66f52b61221a16c.tar.gz
kernel-uprobes-2905544073f6ec235b44f624c66f52b61221a16c.tar.xz
kernel-uprobes-2905544073f6ec235b44f624c66f52b61221a16c.zip
drm/nouveau/pm: Prevent overflow in nouveau_perf_init()
While parsing the perf table, there is no check if the num of entries read from the vbios is less than the currently allocated number. In case of a buggy vbios this will cause overwriting of kernel memory, causing aditional problems. Add a simple check in order to prevent the case Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
-rw-r--r--drivers/gpu/drm/nouveau/nouveau_perf.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/gpu/drm/nouveau/nouveau_perf.c b/drivers/gpu/drm/nouveau/nouveau_perf.c
index 922fb6b664e..ef9dec0e6f8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_perf.c
+++ b/drivers/gpu/drm/nouveau/nouveau_perf.c
@@ -182,6 +182,11 @@ nouveau_perf_init(struct drm_device *dev)
entries = perf[2];
}
+ if (entries > NOUVEAU_PM_MAX_LEVEL) {
+ NV_DEBUG(dev, "perf table has too many entries - buggy vbios?\n");
+ entries = NOUVEAU_PM_MAX_LEVEL;
+ }
+
entry = perf + headerlen;
for (i = 0; i < entries; i++) {
struct nouveau_pm_level *perflvl = &pm->perflvl[pm->nr_perflvl];