mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-28 15:20:41 +00:00
drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
[ Upstream commit136f614931
] The last case label can write two buffers 'mc_reg_address[j]' and 'mc_data[j]' with 'j' offset equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE since there are no checks for this value in both case labels after the last 'j++'. Instead of changing '>' to '>=' there, add the bounds check at the start of the second 'case' (the first one already has it). Also, remove redundant last checks for 'j' index bigger than array size. The expression is always false. Moreover, before or after the patch 'table->last' can be equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE and it seems it can be a valid value. Detected using the static analysis tool - Svace. Fixes:69e0b57a91
("drm/radeon/kms: add dpm support for cayman (v5)") Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
980c3d9d90
commit
ea73869df6
1 changed files with 2 additions and 4 deletions
|
@ -2738,10 +2738,10 @@ static int ni_set_mc_special_registers(struct radeon_device *rdev,
|
|||
table->mc_reg_table_entry[k].mc_data[j] |= 0x100;
|
||||
}
|
||||
j++;
|
||||
if (j > SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE)
|
||||
return -EINVAL;
|
||||
break;
|
||||
case MC_SEQ_RESERVE_M >> 2:
|
||||
if (j >= SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE)
|
||||
return -EINVAL;
|
||||
temp_reg = RREG32(MC_PMG_CMD_MRS1);
|
||||
table->mc_reg_address[j].s1 = MC_PMG_CMD_MRS1 >> 2;
|
||||
table->mc_reg_address[j].s0 = MC_SEQ_PMG_CMD_MRS1_LP >> 2;
|
||||
|
@ -2750,8 +2750,6 @@ static int ni_set_mc_special_registers(struct radeon_device *rdev,
|
|||
(temp_reg & 0xffff0000) |
|
||||
(table->mc_reg_table_entry[k].mc_data[i] & 0x0000ffff);
|
||||
j++;
|
||||
if (j > SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE)
|
||||
return -EINVAL;
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
|
|
Loading…
Reference in a new issue