diff options
| author | Mikhail Kobuk <[email protected]> | 2024-04-11 11:08:52 +0000 |
|---|---|---|
| committer | Danilo Krummrich <[email protected]> | 2024-04-15 08:54:13 +0000 |
| commit | cf92bb778eda7830e79452c6917efa8474a30c1e (patch) | |
| tree | efd25189b895555b7e38c2102da59d52db12e4ba /drivers/gpu/drm/ttm/ttm_pool.c | |
| parent | nouveau: fix instmem race condition around ptr stores (diff) | |
| download | kernel-cf92bb778eda7830e79452c6917efa8474a30c1e.tar.gz kernel-cf92bb778eda7830e79452c6917efa8474a30c1e.zip | |
drm: nv04: Fix out of bounds access
When Output Resource (dcb->or) value is assigned in
fabricate_dcb_output(), there may be out of bounds access to
dac_users array in case dcb->or is zero because ffs(dcb->or) is
used as index there.
The 'or' argument of fabricate_dcb_output() must be interpreted as a
number of bit to set, not value.
Utilize macros from 'enum nouveau_or' in calls instead of hardcoding.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 2e5702aff395 ("drm/nouveau: fabricate DCB encoder table for iMac G4")
Fixes: 670820c0e6a9 ("drm/nouveau: Workaround incorrect DCB entry on a GeForce3 Ti 200.")
Signed-off-by: Mikhail Kobuk <[email protected]>
Signed-off-by: Danilo Krummrich <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
Diffstat (limited to 'drivers/gpu/drm/ttm/ttm_pool.c')
0 files changed, 0 insertions, 0 deletions