Skip to content

Commit

Permalink
drm/amd/display: fix the system memory page fault because of copy ove…
Browse files Browse the repository at this point in the history
…rflow

The buffer is allocated with the size of pointer and copy with the size of
data structure. Then trigger the system memory page fault. Use the
orignal data structure to get the object size.

Fixes: 3a00c04 ("drm/amd/display/dc/core/dc_link: Move some local data from the stack to the heap")
Signed-off-by: Huang Rui <ray.huang@amd.com>
Cc: Lee Jones <lee.jones@linaro.org>
Reviewed-by: Jinzhou.Su <Jinzhou.Su@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
  • Loading branch information
Huang Rui authored and Alex Deucher committed Jan 15, 2021
1 parent 3f5f188 commit b479efb
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions drivers/gpu/drm/amd/display/dc/core/dc_link.c
Original file line number Diff line number Diff line change
Expand Up @@ -1380,7 +1380,7 @@ static bool dc_link_construct(struct dc_link *link,

DC_LOGGER_INIT(dc_ctx->logger);

info = kzalloc(sizeof(info), GFP_KERNEL);
info = kzalloc(sizeof(struct integrated_info), GFP_KERNEL);
if (!info)
goto create_fail;

Expand Down Expand Up @@ -1545,7 +1545,7 @@ static bool dc_link_construct(struct dc_link *link,
}

if (bios->integrated_info)
memcpy(info, bios->integrated_info, sizeof(*info));
memcpy(info, bios->integrated_info, sizeof(struct integrated_info));

/* Look for channel mapping corresponding to connector and device tag */
for (i = 0; i < MAX_NUMBER_OF_EXT_DISPLAY_PATH; i++) {
Expand Down

0 comments on commit b479efb

Please sign in to comment.