drm/stm: ltdc: limit number of layer to avoid memory overflow

If the number of layer is greater than LTDC_MAX_LAYER, we can have
memory overflow when reading plane_fpsi[].

Signed-off-by: Yannick Fertré <yannick.fertre@st.com>
Acked-by: Philippe Cornu <philippe.cornu@st.com>
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/1554283216-2700-1-git-send-email-yannick.fertre@st.com

diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c
index cde2f18ce1c17f5d3d9af30de4992347d8a7ea0b..17438c28d9fc85c712363956d6ba82ed274f75e6 100644 (file)
--- a/drivers/gpu/drm/stm/ltdc.c
+++ b/drivers/gpu/drm/stm/ltdc.c
@@ -1021,10 +1021,13 @@ static int ltdc_get_caps(struct drm_device *ddev)
        struct ltdc_device *ldev = ddev->dev_private;
        u32 bus_width_log2, lcr, gc2r;
 
-       /* at least 1 layer must be managed */
+       /*
+        * at least 1 layer must be managed & the number of layers
+        * must not exceed LTDC_MAX_LAYER
+        */
        lcr = reg_read(ldev->regs, LTDC_LCR);
 
-       ldev->caps.nb_layers = max_t(int, lcr, 1);
+       ldev->caps.nb_layers = clamp((int)lcr, 1, LTDC_MAX_LAYER);
 
        /* set data bus width */
        gc2r = reg_read(ldev->regs, LTDC_GC2R);