mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-01 14:44:12 +00:00
Code Issues Releases Wiki Activity

drm/stm: ltdc: limit number of layer to avoid memory overflow

Browse source 
If the number of layer is greater than LTDC_MAX_LAYER, we can have
memory overflow when reading plane_fpsi[].

Signed-off-by: Yannick Fertré <yannick.fertre@st.com>
Acked-by: Philippe Cornu <philippe.cornu@st.com>
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/1554283216-2700-1-git-send-email-yannick.fertre@st.com
This commit is contained in:
Yannick Fertré 2019-04-03 11:20:16 +02:00 committed by Benjamin Gaignard
parent 8ceb8568d6
commit 77756ad6d0
1 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
drivers/gpu/drm/stm/ltdc.c
View file

@ -1021,10 +1021,13 @@ static int ltdc_get_caps(struct drm_device *ddev)
struct ltdc_device *ldev = ddev->dev_private;
u32 bus_width_log2, lcr, gc2r;
/* at least 1 layer must be managed */
/*
* at least 1 layer must be managed & the number of layers
* must not exceed LTDC_MAX_LAYER
*/
lcr = reg_read(ldev->regs, LTDC_LCR);
ldev->caps.nb_layers = max_t(int, lcr, 1);
ldev->caps.nb_layers = clamp((int)lcr, 1, LTDC_MAX_LAYER);
/* set data bus width */
gc2r = reg_read(ldev->regs, LTDC_GC2R);