diff options
| author | Russell King <rmk+kernel@arm.linux.org.uk> | 2013-12-16 12:39:31 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-12-17 17:12:55 -0800 |
| commit | fd6040ed57d8f200ab0cc2abf706c54995a48370 (patch) | |
| tree | cf23030e471ce6afa0c312e46b6dc81635bda205 | |
| parent | 9fe73d46edd358fc154f7332c8ff312e067255a0 (diff) | |
imx-drm: imx-drm-core: improve safety of imx_drm_add_crtc()staging-3.13-rc5
We must not add more CRTCs than we have declared to the vblank
helpers, otherwise we overflow their arrays. Force failure if we
exceed the number of CRTCs.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Acked-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/imx-drm/imx-drm-core.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c index 19e431dee493..96e4eee344ef 100644 --- a/drivers/staging/imx-drm/imx-drm-core.c +++ b/drivers/staging/imx-drm/imx-drm-core.c @@ -501,6 +501,15 @@ int imx_drm_add_crtc(struct drm_crtc *crtc, mutex_lock(&imxdrm->mutex); + /* + * The vblank arrays are dimensioned by MAX_CRTC - we can't + * pass IDs greater than this to those functions. + */ + if (imxdrm->pipes >= MAX_CRTC) { + ret = -EINVAL; + goto err_busy; + } + if (imxdrm->drm->open_count) { ret = -EBUSY; goto err_busy; |