Re: [PATCH] drm/i915/bios: fix off by one in parse_generic_dtd()
On Thu, 12 Dec 2019, Matt Roper wrote: > On Thu, Dec 12, 2019 at 12:11:30PM +0300, Dan Carpenter wrote: >> The "num_dtd" variable is the number of elements in the >> generic_dtd->dtd[] array so the > needs to be >= to prevent reading one >> element beyond the end of the array. >> >> Fixes: 33ef6d4fd8df ("drm/i915/vbt: Handle generic DTD block") >> Signed-off-by: Dan Carpenter > > Reviewed-by: Matt Roper Pushed to drm-intel-next-queued, thanks for the patch and review. BR, Jani. > >> --- >> drivers/gpu/drm/i915/display/intel_bios.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c >> b/drivers/gpu/drm/i915/display/intel_bios.c >> index 1aeecdd02293..d1e27ee86e53 100644 >> --- a/drivers/gpu/drm/i915/display/intel_bios.c >> +++ b/drivers/gpu/drm/i915/display/intel_bios.c >> @@ -338,7 +338,7 @@ parse_generic_dtd(struct drm_i915_private *dev_priv, >> >> num_dtd = (get_blocksize(generic_dtd) - >> sizeof(struct bdb_generic_dtd)) / generic_dtd->gdtd_size; >> -if (dev_priv->vbt.panel_type > num_dtd) { >> +if (dev_priv->vbt.panel_type >= num_dtd) { >> DRM_ERROR("Panel type %d not found in table of %d DTD's\n", >>dev_priv->vbt.panel_type, num_dtd); >> return; >> -- >> 2.11.0 >> -- Jani Nikula, Intel Open Source Graphics Center ___ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel
Re: [PATCH] drm/i915/bios: fix off by one in parse_generic_dtd()
On Thu, Dec 12, 2019 at 12:11:30PM +0300, Dan Carpenter wrote: > The "num_dtd" variable is the number of elements in the > generic_dtd->dtd[] array so the > needs to be >= to prevent reading one > element beyond the end of the array. > > Fixes: 33ef6d4fd8df ("drm/i915/vbt: Handle generic DTD block") > Signed-off-by: Dan Carpenter Reviewed-by: Matt Roper > --- > drivers/gpu/drm/i915/display/intel_bios.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/display/intel_bios.c > b/drivers/gpu/drm/i915/display/intel_bios.c > index 1aeecdd02293..d1e27ee86e53 100644 > --- a/drivers/gpu/drm/i915/display/intel_bios.c > +++ b/drivers/gpu/drm/i915/display/intel_bios.c > @@ -338,7 +338,7 @@ parse_generic_dtd(struct drm_i915_private *dev_priv, > > num_dtd = (get_blocksize(generic_dtd) - > sizeof(struct bdb_generic_dtd)) / generic_dtd->gdtd_size; > - if (dev_priv->vbt.panel_type > num_dtd) { > + if (dev_priv->vbt.panel_type >= num_dtd) { > DRM_ERROR("Panel type %d not found in table of %d DTD's\n", > dev_priv->vbt.panel_type, num_dtd); > return; > -- > 2.11.0 > -- Matt Roper Graphics Software Engineer VTT-OSGC Platform Enablement Intel Corporation (916) 356-2795 ___ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel
[PATCH] drm/i915/bios: fix off by one in parse_generic_dtd()
The "num_dtd" variable is the number of elements in the generic_dtd->dtd[] array so the > needs to be >= to prevent reading one element beyond the end of the array. Fixes: 33ef6d4fd8df ("drm/i915/vbt: Handle generic DTD block") Signed-off-by: Dan Carpenter --- drivers/gpu/drm/i915/display/intel_bios.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c index 1aeecdd02293..d1e27ee86e53 100644 --- a/drivers/gpu/drm/i915/display/intel_bios.c +++ b/drivers/gpu/drm/i915/display/intel_bios.c @@ -338,7 +338,7 @@ parse_generic_dtd(struct drm_i915_private *dev_priv, num_dtd = (get_blocksize(generic_dtd) - sizeof(struct bdb_generic_dtd)) / generic_dtd->gdtd_size; - if (dev_priv->vbt.panel_type > num_dtd) { + if (dev_priv->vbt.panel_type >= num_dtd) { DRM_ERROR("Panel type %d not found in table of %d DTD's\n", dev_priv->vbt.panel_type, num_dtd); return; -- 2.11.0 ___ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel