From: Imre Deak Date: Fri, 29 Jan 2016 12:44:29 +0000 (+0200) Subject: drm/mst: Add range check for max_payloads during init X-Git-Tag: v4.14-rc1~3868^2^2~6 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=4d6a10da79fddcf7460299ab390da74ef2b592f6;p=platform%2Fkernel%2Flinux-rpi.git drm/mst: Add range check for max_payloads during init max_payload is limited by the space we have in drm_dp_mst_topology_mgr::vcpi_mask,payload_mask. We need to track max_payloads+1 IDs in these masks, see drm_dp_mst_assign_payload_id(). Add a sanity check for this. Caught by coverity. Signed-off-by: Imre Deak Reviewed-by: David Weinehall Signed-off-by: Dave Airlie --- diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c index 2b7c2f068834..0680e7aecac4 100644 --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -2848,6 +2848,9 @@ int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr, mgr->max_dpcd_transaction_bytes = max_dpcd_transaction_bytes; mgr->max_payloads = max_payloads; mgr->conn_base_id = conn_base_id; + if (max_payloads + 1 > sizeof(mgr->payload_mask) * 8 || + max_payloads + 1 > sizeof(mgr->vcpi_mask) * 8) + return -EINVAL; mgr->payloads = kcalloc(max_payloads, sizeof(struct drm_dp_payload), GFP_KERNEL); if (!mgr->payloads) return -ENOMEM;