diff options
| author | Yannick Fertré | 2019-04-03 11:20:16 +0200 |
|---|---|---|
| committer | Benjamin Gaignard | 2019-04-24 13:52:06 +0200 |
| commit | 77756ad6d08fb3f276d357be4c318f871dab8734 (patch) | |
| tree | de84d976d1f6d8b398d73bc486ba1deb4da317ef /drivers/gpu/drm/stm | |
| parent | 8ceb8568d6e8d53dc000a9eeacd47c8f298c38f0 (diff) | |
drm/stm: ltdc: limit number of layer to avoid memory overflow
If the number of layer is greater than LTDC_MAX_LAYER, we can have
memory overflow when reading plane_fpsi[].
Signed-off-by: Yannick Fertré <yannick.fertre@st.com>
Acked-by: Philippe Cornu <philippe.cornu@st.com>
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/1554283216-2700-1-git-send-email-yannick.fertre@st.com
Diffstat (limited to 'drivers/gpu/drm/stm')
| -rw-r--r-- | drivers/gpu/drm/stm/ltdc.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c index cde2f18ce1c1..17438c28d9fc 100644 --- a/drivers/gpu/drm/stm/ltdc.c +++ b/drivers/gpu/drm/stm/ltdc.c @@ -1021,10 +1021,13 @@ static int ltdc_get_caps(struct drm_device *ddev) struct ltdc_device *ldev = ddev->dev_private; u32 bus_width_log2, lcr, gc2r; - /* at least 1 layer must be managed */ + /* + * at least 1 layer must be managed & the number of layers + * must not exceed LTDC_MAX_LAYER + */ lcr = reg_read(ldev->regs, LTDC_LCR); - ldev->caps.nb_layers = max_t(int, lcr, 1); + ldev->caps.nb_layers = clamp((int)lcr, 1, LTDC_MAX_LAYER); /* set data bus width */ gc2r = reg_read(ldev->regs, LTDC_GC2R); |