openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

drm/nouveau/bios/bitP: check that table is long enough for optional pointers 

Fixes OOB VBIOS accesses on some boards.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This commit is contained in:
Ben Skeggs 2017-04-11 08:25:22 +10:00
parent eef4988ab4
commit a7cb78bab3
5 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/gpu/drm/nouveau/nvkm/subdev/bios/boost.c
View File

@ -33,7 +33,7 @@ nvbios_boostTe(struct nvkm_bios *bios,
u32 boost = 0; u32 boost = 0;
if (!bit_entry(bios, 'P', &bit_P)) { if (!bit_entry(bios, 'P', &bit_P)) {
if (bit_P.version == 2) if (bit_P.version == 2 && bit_P.length >= 0x34)
boost = nvbios_rd32(bios, bit_P.offset + 0x30); boost = nvbios_rd32(bios, bit_P.offset + 0x30);
if (boost) { if (boost) {

2
drivers/gpu/drm/nouveau/nvkm/subdev/bios/cstep.c
View File

@ -33,7 +33,7 @@ nvbios_cstepTe(struct nvkm_bios *bios,
u32 cstep = 0; u32 cstep = 0;
if (!bit_entry(bios, 'P', &bit_P)) { if (!bit_entry(bios, 'P', &bit_P)) {
if (bit_P.version == 2) if (bit_P.version == 2 && bit_P.length >= 0x38)
cstep = nvbios_rd32(bios, bit_P.offset + 0x34); cstep = nvbios_rd32(bios, bit_P.offset + 0x34);
if (cstep) { if (cstep) {

2
drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c
View File

@ -32,7 +32,7 @@ nvbios_fan_table(struct nvkm_bios *bios, u8 *ver, u8 *hdr, u8 *cnt, u8 *len)
u32 fan = 0; u32 fan = 0;
if (!bit_entry(bios, 'P', &bit_P)) { if (!bit_entry(bios, 'P', &bit_P)) {
if (bit_P.version == 2 && bit_P.length >= 0x5a) if (bit_P.version == 2 && bit_P.length >= 0x5c)
fan = nvbios_rd32(bios, bit_P.offset + 0x58); fan = nvbios_rd32(bios, bit_P.offset + 0x58);
if (fan) { if (fan) {

2
drivers/gpu/drm/nouveau/nvkm/subdev/bios/power_budget.c
View File

@ -33,7 +33,7 @@ nvbios_power_budget_table(struct nvkm_bios *bios, u8 *ver, u8 *hdr, u8 *cnt,
u32 power_budget; u32 power_budget;
if (bit_entry(bios, 'P', &bit_P) || bit_P.version != 2 || if (bit_entry(bios, 'P', &bit_P) || bit_P.version != 2 ||
bit_P.length < 0x2c) bit_P.length < 0x30)
return 0; return 0;
power_budget = nvbios_rd32(bios, bit_P.offset + 0x2c); power_budget = nvbios_rd32(bios, bit_P.offset + 0x2c);

2
drivers/gpu/drm/nouveau/nvkm/subdev/bios/vpstate.c
View File

@ -31,7 +31,7 @@ nvbios_vpstate_offset(struct nvkm_bios *b)
struct bit_entry bit_P; struct bit_entry bit_P;
if (!bit_entry(b, 'P', &bit_P)) { if (!bit_entry(b, 'P', &bit_P)) {
if (bit_P.version == 2) if (bit_P.version == 2 && bit_P.length >= 0x3c)
return nvbios_rd32(b, bit_P.offset + 0x38); return nvbios_rd32(b, bit_P.offset + 0x38);
} }