Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e1718d97 authored by Alex Deucher's avatar Alex Deucher
Browse files

drm/amdgpu: avoid a possible array overflow 

When looking up the connector type make sure the index
is valid.  Avoids a later crash if we read past the end
of the array.

Workaround for bug:
https://bugs.freedesktop.org/show_bug.cgi?id=97460



Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
parent 56615387

drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c

+6 −0
Original line number Diff line number Diff line
@@ -321,6 +321,12 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device * 
			    (le16_to_cpu(path->usConnObjectId) &

			     OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;



			if (con_obj_id >= ARRAY_SIZE(object_connector_convert)) {

				DRM_ERROR("invalid con_obj_id %d for device tag 0x%04x\n",

					  con_obj_id, le16_to_cpu(path->usDeviceTag));

				continue;

			}



			connector_type =

				object_connector_convert[con_obj_id];

			connector_object_id = con_obj_id;