45 lines
1.8 KiB
Diff
45 lines
1.8 KiB
Diff
From: John Lindgren <john.lindgren@tds.net>
|
|
Subject: [PATCH] drm/radeon/kms: add some sanity checks to obj info record parsing
|
|
|
|
Fixes:
|
|
https://bugs.freedesktop.org/show_bug.cgi?id=35502
|
|
|
|
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
|
|
index 02d5c41..99768d9 100644
|
|
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
|
|
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
|
|
@@ -675,7 +675,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
|
|
ATOM_ENCODER_CAP_RECORD *cap_record;
|
|
u16 caps = 0;
|
|
|
|
- while (record->ucRecordType > 0 &&
|
|
+ while (record->ucRecordSize > 0 &&
|
|
+ record->ucRecordType > 0 &&
|
|
record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) {
|
|
switch (record->ucRecordType) {
|
|
case ATOM_ENCODER_CAP_RECORD_TYPE:
|
|
@@ -720,7 +721,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
|
|
break;
|
|
}
|
|
|
|
- while (record->ucRecordType > 0 &&
|
|
+ while (record->ucRecordSize > 0 &&
|
|
+ record->ucRecordType > 0 &&
|
|
record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) {
|
|
switch (record->ucRecordType) {
|
|
case ATOM_I2C_RECORD_TYPE:
|
|
@@ -782,10 +784,9 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
|
|
ATOM_HPD_INT_RECORD *hpd_record;
|
|
ATOM_I2C_ID_CONFIG_ACCESS *i2c_config;
|
|
|
|
- while (record->ucRecordType > 0
|
|
- && record->
|
|
- ucRecordType <=
|
|
- ATOM_MAX_OBJECT_RECORD_NUMBER) {
|
|
+ while (record->ucRecordSize > 0 &&
|
|
+ record->ucRecordType > 0 &&
|
|
+ record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) {
|
|
switch (record->ucRecordType) {
|
|
case ATOM_I2C_RECORD_TYPE:
|
|
i2c_record =
|