[PATCH v6 10/13] drm/bridge: it6505: reject a too short link-frequencies property
From: Daniel Golle
Date: Fri Jul 24 2026 - 23:02:20 EST
of_property_read_variable_u64_array() is asked for a minimum array
size of zero, so a link-frequencies property shorter than one u64 --
a 32-bit value written by mistake, say -- returns 0 without storing
anything. it6505_parse_dt() reads that as success and derives
max_dpi_pixel_clock from an uninitialised stack variable. Ask for one
element so a short property lands in the existing error path.
Fixes: 380d920b582d ("drm/bridge: add it6505 driver to read data-lanes and link-frequencies from dt")
Signed-off-by: Daniel Golle <daniel@xxxxxxxxxxxxxx>
---
v6: new patch
drivers/gpu/drm/bridge/ite-it6505.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index 0da8b40dd88a..1678ec5b3ba7 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -3389,7 +3389,7 @@ static void it6505_parse_dt(struct it6505 *it6505)
if (ep) {
len = of_property_read_variable_u64_array(ep,
"link-frequencies",
- &link_frequencies, 0,
+ &link_frequencies, 1,
1);
if (len >= 0) {
do_div(link_frequencies, 1000);
--
2.55.0