aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEmil Velikov <emil.l.velikov@gmail.com>2011-06-11 08:30:32 -0400
committerBen Skeggs <bskeggs@redhat.com>2011-06-18 00:38:38 -0400
commit2905544073f6ec235b44f624c66f52b61221a16c (patch)
tree87daa81b07538956e110e84631617be5c1bc5691
parent0897554cdd9de8a9f6f93d9ba27c7ebfae286158 (diff)
drm/nouveau/pm: Prevent overflow in nouveau_perf_init()
While parsing the perf table, there is no check if the num of entries read from the vbios is less than the currently allocated number. In case of a buggy vbios this will cause overwriting of kernel memory, causing aditional problems. Add a simple check in order to prevent the case Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
-rw-r--r--drivers/gpu/drm/nouveau/nouveau_perf.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/gpu/drm/nouveau/nouveau_perf.c b/drivers/gpu/drm/nouveau/nouveau_perf.c
index 922fb6b664ed..ef9dec0e6f8b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_perf.c
+++ b/drivers/gpu/drm/nouveau/nouveau_perf.c
@@ -182,6 +182,11 @@ nouveau_perf_init(struct drm_device *dev)
182 entries = perf[2]; 182 entries = perf[2];
183 } 183 }
184 184
185 if (entries > NOUVEAU_PM_MAX_LEVEL) {
186 NV_DEBUG(dev, "perf table has too many entries - buggy vbios?\n");
187 entries = NOUVEAU_PM_MAX_LEVEL;
188 }
189
185 entry = perf + headerlen; 190 entry = perf + headerlen;
186 for (i = 0; i < entries; i++) { 191 for (i = 0; i < entries; i++) {
187 struct nouveau_pm_level *perflvl = &pm->perflvl[pm->nr_perflvl]; 192 struct nouveau_pm_level *perflvl = &pm->perflvl[pm->nr_perflvl];