drm/nouveau/pm: Prevent overflow in nouveau_perf_init()

While parsing the perf table, there is no check if
the num of entries read from the vbios is less than
the currently allocated number.

In case of a buggy vbios this will cause overwriting
of kernel memory, causing aditional problems.

Add a simple check in order to prevent the case

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

diff --git a/drivers/gpu/drm/nouveau/nouveau_perf.c b/drivers/gpu/drm/nouveau/nouveau_perf.c
index 922fb6b664edda718e2e15f929500a2fe3967d21..ef9dec0e6f8b343c293eb7002560686838731180 100644 (file)
--- a/drivers/gpu/drm/nouveau/nouveau_perf.c
+++ b/drivers/gpu/drm/nouveau/nouveau_perf.c
@@ -182,6 +182,11 @@ nouveau_perf_init(struct drm_device *dev)
                entries   = perf[2];
        }
 
+       if (entries > NOUVEAU_PM_MAX_LEVEL) {
+               NV_DEBUG(dev, "perf table has too many entries - buggy vbios?\n");
+               entries = NOUVEAU_PM_MAX_LEVEL;
+       }
+
        entry = perf + headerlen;
        for (i = 0; i < entries; i++) {
                struct nouveau_pm_level *perflvl = &pm->perflvl[pm->nr_perflvl];