Author: kib
Date: Tue Feb 3 13:43:03 2015
New Revision: 278152
URL: https://svnweb.freebsd.org/changeset/base/278152
Log:
Do not access gmbus_ports array past its end.
Reported and tested by: hselasky
Sponsored by: The FreeBSD Foundation
Modified:
head/sys/dev/drm2/i915/intel_iic.c
Modified: head/sys/dev/drm2/i915/intel_iic.c
==============================================================================
--- head/sys/dev/drm2/i915/intel_iic.c Tue Feb 3 12:09:48 2015
(r278151)
+++ head/sys/dev/drm2/i915/intel_iic.c Tue Feb 3 13:43:03 2015
(r278152)
@@ -556,7 +556,9 @@ intel_gmbus_attach(device_t idev)
pin = device_get_unit(idev);
port = pin + 1;
- snprintf(sc->name, sizeof(sc->name), "gmbus %s", gmbus_ports[pin].name);
+ snprintf(sc->name, sizeof(sc->name), "gmbus %s",
+ intel_gmbus_is_port_valid(port) ? gmbus_ports[pin].name :
+ "reserved");
device_set_desc(idev, sc->name);
/* By default use a conservative clock rate */
@@ -613,17 +615,21 @@ intel_iicbb_attach(device_t idev)
{
struct intel_iic_softc *sc;
struct drm_i915_private *dev_priv;
- int pin;
+ int pin, port;
sc = device_get_softc(idev);
sc->drm_dev = device_get_softc(device_get_parent(idev));
dev_priv = sc->drm_dev->dev_private;
pin = device_get_unit(idev);
+ port = pin + 1;
snprintf(sc->name, sizeof(sc->name), "i915 iicbb %s",
- gmbus_ports[pin].name);
+ intel_gmbus_is_port_valid(port) ? gmbus_ports[pin].name :
+ "reserved");
device_set_desc(idev, sc->name);
+ if (!intel_gmbus_is_port_valid(port))
+ pin = 1 ; /* GPIOA, VGA */
sc->reg0 = pin | GMBUS_RATE_100KHZ;
sc->reg = dev_priv->gpio_mmio_base + gmbus_ports[pin].reg;
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
