[PATCH v6 10/13] drm/bridge: it6505: reject a too short link-frequencies property
From: Daniel Golle <daniel@makrotopia.org>
Date: 2026-07-25 03:00:32
Also in:
dri-devel, linux-mediatek, lkml
Subsystem:
drm drivers, drm drivers and misc gpu patches, drm drivers for bridge chips, the rest · Maintainers:
David Airlie, Simona Vetter, Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, Andrzej Hajda, Neil Armstrong, Robert Foss, Linus Torvalds
of_property_read_variable_u64_array() is asked for a minimum array
size of zero, so a link-frequencies property shorter than one u64 --
a 32-bit value written by mistake, say -- returns 0 without storing
anything. it6505_parse_dt() reads that as success and derives
max_dpi_pixel_clock from an uninitialised stack variable. Ask for one
element so a short property lands in the existing error path.
Fixes: 380d920b582d ("drm/bridge: add it6505 driver to read data-lanes and link-frequencies from dt")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
---
v6: new patch
drivers/gpu/drm/bridge/ite-it6505.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index 0da8b40dd88a..1678ec5b3ba7 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c@@ -3389,7 +3389,7 @@ static void it6505_parse_dt(struct it6505 *it6505) if (ep) { len = of_property_read_variable_u64_array(ep, "link-frequencies", - &link_frequencies, 0, + &link_frequencies, 1, 1); if (len >= 0) { do_div(link_frequencies, 1000);
--
2.55.0