diff options
| author | Ben Skeggs <bskeggs@redhat.com> | 2016-06-02 04:23:31 +0200 |
|---|---|---|
| committer | Ben Skeggs <bskeggs@redhat.com> | 2016-06-02 05:53:44 +0200 |
| commit | f045f459d925138fe7d6193a8c86406bda7e49da (patch) | |
| tree | f00acbaf667b587b9e0cbdcb00d16826cbc12429 /drivers/gpu/drm/nouveau/nvc0_fbcon.c | |
| parent | drm/nouveau/gr/gf100-: update sm error decoding from gk20a nvgpu headers (diff) | |
| download | linux-f045f459d925138fe7d6193a8c86406bda7e49da.tar.xz linux-f045f459d925138fe7d6193a8c86406bda7e49da.zip | |
drm/nouveau/fbcon: fix out-of-bounds memory accesses
Reported by KASAN.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Cc: stable@vger.kernel.org
Diffstat (limited to 'drivers/gpu/drm/nouveau/nvc0_fbcon.c')
| -rw-r--r-- | drivers/gpu/drm/nouveau/nvc0_fbcon.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/drivers/gpu/drm/nouveau/nvc0_fbcon.c b/drivers/gpu/drm/nouveau/nvc0_fbcon.c index a0913359ac05..839f4c8c1805 100644 --- a/drivers/gpu/drm/nouveau/nvc0_fbcon.c +++ b/drivers/gpu/drm/nouveau/nvc0_fbcon.c @@ -95,7 +95,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) struct nouveau_fbdev *nfbdev = info->par; struct nouveau_drm *drm = nouveau_drm(nfbdev->dev); struct nouveau_channel *chan = drm->channel; - uint32_t width, dwords, *data = (uint32_t *)image->data; + uint32_t dwords, *data = (uint32_t *)image->data; uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel)); uint32_t *palette = info->pseudo_palette; int ret; @@ -107,9 +107,6 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) if (ret) return ret; - width = ALIGN(image->width, 32); - dwords = (width * image->height) >> 5; - BEGIN_NVC0(chan, NvSub2D, 0x0814, 2); if (info->fix.visual == FB_VISUAL_TRUECOLOR || info->fix.visual == FB_VISUAL_DIRECTCOLOR) { @@ -128,6 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) OUT_RING (chan, 0); OUT_RING (chan, image->dy); + dwords = ALIGN(image->width * image->height, 32) >> 5; while (dwords) { int push = dwords > 2047 ? 2047 : dwords; |