ARGH! typo in the last one. fixed version attached. >From e8c539f60ae55d002a19534a375448a2cd3aa2b3 Mon Sep 17 00:00:00 2001 From: Alex Deucher <alexdeuc...@gmail.com> Date: Thu, 1 Apr 2010 15:06:11 -0400 Subject: [PATCH] drm/radeon/kms/atom: fix gpio i2c table overrun (v2)
The GPIO_I2C_INFO table does not always have
ATOM_MAX_SUPPORTED_DEVICE entries. Limit
the number of indices to the size of the
table.
Should fix Novell bug 589022.
v2: fix typo
Signed-off-by: Alex Deucher <alexdeuc...@gmail.com>
Cc: Stable <sta...@kernel.org>
---
drivers/gpu/drm/radeon/radeon_atombios.c | 11 +++++++----
1 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c
b/drivers/gpu/drm/radeon/radeon_atombios.c
index b969eda..2730199 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -69,16 +69,19 @@ static inline struct radeon_i2c_bus_rec
radeon_lookup_i2c_gpio(struct radeon_dev
struct radeon_i2c_bus_rec i2c;
int index = GetIndexIntoMasterTable(DATA, GPIO_I2C_Info);
struct _ATOM_GPIO_I2C_INFO *i2c_info;
- uint16_t data_offset;
- int i;
+ uint16_t data_offset, size;
+ int i, num_indices;
memset(&i2c, 0, sizeof(struct radeon_i2c_bus_rec));
i2c.valid = false;
- if (atom_parse_data_header(ctx, index, NULL, NULL, NULL, &data_offset))
{
+ if (atom_parse_data_header(ctx, index, &size, NULL, NULL,
&data_offset)) {
i2c_info = (struct _ATOM_GPIO_I2C_INFO *)(ctx->bios +
data_offset);
- for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) {
+ num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
+ sizeof(ATOM_GPIO_I2C_ASSIGMENT);
+
+ for (i = 0; i < num_indices; i++) {
gpio = &i2c_info->asGPIO_Info[i];
if (gpio->sucI2cId.ucAccess == id) {
--
1.5.6.3
On Thu, Apr 1, 2010 at 12:57 PM, Alex Deucher <alexdeuc...@gmail.com> wrote:
> From 540daa603d7fa968b858c04f32ebad7d256b480c Mon Sep 17 00:00:00 2001
> From: Alex Deucher <alexdeuc...@gmail.com>
> Date: Thu, 1 Apr 2010 12:55:34 -0400
> Subject: [PATCH] drm/radeon/kms/atom: fix gpio i2c table overrun
>
> The GPIO_I2C_INFO table does not always have
> ATOM_MAX_SUPPORTED_DEVICE entries. Limit
> the number of indices to the size of the
> table.
>
> Should fix Novell bug 589022.
>
> Signed-off-by: Alex Deucher <alexdeuc...@gmail.com>
> Cc: Stable <sta...@kernel.org>
> ---
> drivers/gpu/drm/radeon/radeon_atombios.c | 11 +++++++----
> 1 files changed, 7 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c
> b/drivers/gpu/drm/radeon/radeon_atombios.c
> index b969eda..bb37da4 100644
> --- a/drivers/gpu/drm/radeon/radeon_atombios.c
> +++ b/drivers/gpu/drm/radeon/radeon_atombios.c
> @@ -69,16 +69,19 @@ static inline struct radeon_i2c_bus_rec
> radeon_lookup_i2c_gpio(struct radeon_dev
> struct radeon_i2c_bus_rec i2c;
> int index = GetIndexIntoMasterTable(DATA, GPIO_I2C_Info);
> struct _ATOM_GPIO_I2C_INFO *i2c_info;
> - uint16_t data_offset;
> - int i;
> + uint16_t data_offset, size;
> + int i, num_indices;
>
> memset(&i2c, 0, sizeof(struct radeon_i2c_bus_rec));
> i2c.valid = false;
>
> - if (atom_parse_data_header(ctx, index, NULL, NULL, NULL,
> &data_offset)) {
> + if (atom_parse_data_header(ctx, index, &size, NULL, NULL,
> &data_offset)) {
> i2c_info = (struct _ATOM_GPIO_I2C_INFO *)(ctx->bios +
> data_offset);
>
> - for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) {
> + num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
> + sizeof(ATOM_GPIO_I2C_INFO);
> +
> + for (i = 0; i < num_indices; i++) {
> gpio = &i2c_info->asGPIO_Info[i];
>
> if (gpio->sucI2cId.ucAccess == id) {
> --
> 1.5.6.3
>
0001-drm-radeon-kms-atom-fix-gpio-i2c-table-overrun-v2.patch
Description: application/mbox
------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev
-- _______________________________________________ Dri-devel mailing list Dri-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/dri-devel
