Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 761c5a69 authored by Marcin Slusarz's avatar Marcin Slusarz Committed by Ben Skeggs
Browse files

drm/nouveau: fix i2ctable bounds checking 



i2c_entries seems to be the number of i2c entries,
so with index equal to this number, we could read
invalid data from i2ctable. Fix it.

Signed-off-by: default avatarMarcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: default avatarFrancisco Jerez <currojerez@riseup.net>
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
parent b762b8ce

drivers/gpu/drm/nouveau/nouveau_bios.c

+4 −3
Original line number Diff line number Diff line
@@ -4984,7 +4984,8 @@ read_dcb_i2c_entry(struct drm_device *dev, int dcb_version, uint8_t *i2ctable, i 
		else

			NV_WARN(dev,

				"DCB I2C table has more entries than indexable "

				"(%d entries, max index 15)\n", i2ctable[2]);

				"(%d entries, max %d)\n", i2ctable[2],

				DCB_MAX_NUM_I2C_ENTRIES);

		entry_len = i2ctable[3];

		/* [4] is i2c_default_indices, read in parse_dcb_table() */

	}
@@ -5000,8 +5001,8 @@ read_dcb_i2c_entry(struct drm_device *dev, int dcb_version, uint8_t *i2ctable, i 


	if (index == 0xf)

		return 0;

	if (index > i2c_entries) {

		NV_ERROR(dev, "DCB I2C index too big (%d > %d)\n",

	if (index >= i2c_entries) {

		NV_ERROR(dev, "DCB I2C index too big (%d >= %d)\n",

			 index, i2ctable[2]);

		return -ENOENT;

	}