]> Git Repo - linux.git/commit
drm: nv04: Fix out of bounds access
authorMikhail Kobuk <[email protected]>
Thu, 11 Apr 2024 11:08:52 +0000 (14:08 +0300)
committerDanilo Krummrich <[email protected]>
Mon, 15 Apr 2024 08:54:13 +0000 (10:54 +0200)
commitcf92bb778eda7830e79452c6917efa8474a30c1e
treeefd25189b895555b7e38c2102da59d52db12e4ba
parentfff1386cc889d8fb4089d285f883f8cba62d82ce
drm: nv04: Fix out of bounds access

When Output Resource (dcb->or) value is assigned in
fabricate_dcb_output(), there may be out of bounds access to
dac_users array in case dcb->or is zero because ffs(dcb->or) is
used as index there.
The 'or' argument of fabricate_dcb_output() must be interpreted as a
number of bit to set, not value.

Utilize macros from 'enum nouveau_or' in calls instead of hardcoding.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 2e5702aff395 ("drm/nouveau: fabricate DCB encoder table for iMac G4")
Fixes: 670820c0e6a9 ("drm/nouveau: Workaround incorrect DCB entry on a GeForce3 Ti 200.")
Signed-off-by: Mikhail Kobuk <[email protected]>
Signed-off-by: Danilo Krummrich <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
drivers/gpu/drm/nouveau/nouveau_bios.c
This page took 0.050974 seconds and 4 git commands to generate.