Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4d6a10da authored by Imre Deak's avatar Imre Deak Committed by Dave Airlie
Browse files

drm/mst: Add range check for max_payloads during init 



max_payload is limited by the space we have in
drm_dp_mst_topology_mgr::vcpi_mask,payload_mask. We need to track
max_payloads+1 IDs in these masks, see drm_dp_mst_assign_payload_id().
Add a sanity check for this.

Caught by coverity.

Signed-off-by: default avatarImre Deak <imre.deak@intel.com>
Reviewed-by: default avatarDavid Weinehall <david.weinehall@intel.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent 441388a8

drivers/gpu/drm/drm_dp_mst_topology.c

+3 −0
Original line number Diff line number Diff line
@@ -2848,6 +2848,9 @@ int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr, 
	mgr->max_dpcd_transaction_bytes = max_dpcd_transaction_bytes;

	mgr->max_payloads = max_payloads;

	mgr->conn_base_id = conn_base_id;

	if (max_payloads + 1 > sizeof(mgr->payload_mask) * 8 ||

	    max_payloads + 1 > sizeof(mgr->vcpi_mask) * 8)

		return -EINVAL;

	mgr->payloads = kcalloc(max_payloads, sizeof(struct drm_dp_payload), GFP_KERNEL);

	if (!mgr->payloads)

		return -ENOMEM;