mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-02 18:04:38 -04:00
Code Issues Packages Projects Releases Wiki Activity

drm/i915/bios: double check array-boundary in parse_sdvo_lvds_data

Browse Source 
During static analysis, a concern was raised that we may access the
dtd->dtd[] array out of bounds, because we are not checking whether
the index we use is larger than the array.

This should not be a problem as is, because the enumeration that is
used for this index comes from "panel_type", which uses an enumeration
with 4 items.  But if this enumeration is ever changed, it can lead to
hard-to-detect bugs, so better double-check it before using it as an
index to the array.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240528112901.476068-2-luciano.coelho@intel.com
This commit is contained in:
Luca Coelho
2024-05-28 14:29:00 +03:00
committed by Suraj Kandpal
parent 45fe957ae7
commit b2c2f2df6f
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/gpu/drm/i915/display/intel_bios.c
View File

@@ -1120,6 +1120,18 @@ parse_sdvo_lvds_data(struct drm_i915_private *i915,
if (!dtd)
return;
/*
* This should not happen, as long as the panel_type
* enumeration doesn't grow over 4 items. But if it does, it
* could lead to hard-to-detect bugs, so better double-check
* it here to be sure.
*/
if (index >= ARRAY_SIZE(dtd->dtd)) {
drm_err(&i915->drm, "index %d is larger than dtd->dtd[4] array\n",
index);
return;
}
panel_fixed_mode = kzalloc(sizeof(*panel_fixed_mode), GFP_KERNEL);
if (!panel_fixed_mode)
return;