From patchwork Mon Aug 21 10:32:51 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maciej Purski X-Patchwork-Id: 9912045 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 159AA600C8 for ; Mon, 21 Aug 2017 10:33:15 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0430422376 for ; Mon, 21 Aug 2017 10:33:15 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id ED093286D9; Mon, 21 Aug 2017 10:33:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 3F6F122376 for ; Mon, 21 Aug 2017 10:33:13 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 2A0D66E1A6; Mon, 21 Aug 2017 10:33:12 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mailout1.w1.samsung.com (mailout1.w1.samsung.com [210.118.77.11]) by gabe.freedesktop.org (Postfix) with ESMTPS id 9AE526E1A6 for ; Mon, 21 Aug 2017 10:33:10 +0000 (UTC) Received: from eucas1p1.samsung.com (unknown [182.198.249.206]) by mailout1.w1.samsung.com (KnoxPortal) with ESMTP id 20170821103307euoutp0160c150d0613c640f958d58fe0c1a970b~c1eygDxhq2853628536euoutp01L; Mon, 21 Aug 2017 10:33:07 +0000 (GMT) Received: from eusmges2.samsung.com (unknown [203.254.199.241]) by eucas1p1.samsung.com (KnoxPortal) with ESMTP id 20170821103307eucas1p10fed8d4f7554534edbea3b4d0adad56e~c1eyCYNUu0380503805eucas1p1P; Mon, 21 Aug 2017 10:33:07 +0000 (GMT) Received: from eucas1p1.samsung.com ( [182.198.249.206]) by eusmges2.samsung.com (EUCPMTA) with SMTP id 9F.08.12907.3E6BA995; Mon, 21 Aug 2017 11:33:07 +0100 (BST) Received: from eusmgms2.samsung.com (unknown [182.198.249.180]) by eucas1p2.samsung.com (KnoxPortal) with ESMTP id 20170821103306eucas1p204dcad5c21e623af92859b61ad2528f3~c1exU0-nn1549015490eucas1p2D; Mon, 21 Aug 2017 10:33:06 +0000 (GMT) X-AuditID: cbfec7f1-f793a6d00000326b-59-599ab6e345d6 Received: from eusync4.samsung.com ( [203.254.199.214]) by eusmgms2.samsung.com (EUCPMTA) with SMTP id 28.9C.20118.2E6BA995; Mon, 21 Aug 2017 11:33:06 +0100 (BST) Received: from AMDC2075.DIGITAL.local ([106.120.51.25]) by eusync4.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTPA id <0OV100G7B6MYNS40@eusync4.samsung.com>; Mon, 21 Aug 2017 11:33:06 +0100 (BST) From: Maciej Purski To: dri-devel@lists.freedesktop.org Subject: [PATCH] drm/bridge/sii8620: Fix memory corruption Date: Mon, 21 Aug 2017 12:32:51 +0200 Message-id: <1503311571-25819-1-git-send-email-m.purski@samsung.com> X-Mailer: git-send-email 2.7.4 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrOIsWRmVeSWpSXmKPExsWy7djPc7qPt82KNDi4nNPi1rpzrBa9504y WTR1vGW1uPL1PZtF58Ql7BYLXt5icWDzuNzXy+Qxu2Mmq8f2bw9YPe53H2fy6NuyijGANYrL JiU1J7MstUjfLoEr48WC1+wFCzgqPk3+yNrA+JGti5GTQ0LAROLp4rmsELaYxIV764HiXBxC AksZJWZd/sMM4XxmlHh5dTk7TMedmcsYIRLLGCUmrrnGDuH8Z5TYvbkHKMPBwSagJbGmPR6k QURAWeLvxFVgDcwCPYwSZz+1MoEkhAWsJH78WA12B4uAqsS5pV/B4rwCLhKPGmewQGyTk7h5 rhPsDAmBy2wSa+a0MYEskBCQldh0gBmixkVi4owGqOuEJV4d3wJly0hcntwNNada4uLXXVA/ 10g03t4AVWMt8XnSFrA5zAJ8EpO2TWeGGM8r0dEmBFHiIfF/+QqorY4S345XgoSFBGIl1nz6 yzaBUXoBI8MqRpHU0uLc9NRiI73ixNzi0rx0veT83E2MwOg8/e/4xx2M709YHWIU4GBU4uE1 KJoVKcSaWFZcmXuIUYKDWUmEd9dCoBBvSmJlVWpRfnxRaU5q8SFGaQ4WJXFe26i2SCGB9MSS 1OzU1ILUIpgsEwenVAOj9+IrJXpJX2fvmevV3qDJOd+veoVU6PE7vstK69OXmJRliz2Z/DjC ZukjaaMX7+XPBi/8atsT2fPvkZJavMHRI/kNuy5K7GB+7LfuVvMS12zltLcBc96v2dt6VXxC Y9OeXxOmty5QKvttl/y58ax69VPeYlu1yqiQVvv6bc3bvn9Mt9G8+iNUiaU4I9FQi7moOBEA 06zpVMoCAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrLLMWRmVeSWpSXmKPExsVy+t/xa7qPts2KNLi2Qc3i1rpzrBa9504y WTR1vGW1uPL1PZtF58Ql7BYLXt5icWDzuNzXy+Qxu2Mmq8f2bw9YPe53H2fy6NuyijGANcrN JiM1MSW1SCE1Lzk/JTMv3VYpNMRN10JJIS8xN9VWKULXNyRISaEsMacUyDMyQAMOzgHuwUr6 dgluGS8WvGYvWMBR8WnyR9YGxo9sXYycHBICJhJ3Zi5jhLDFJC7cWw8U5+IQEljCKHH7+j8o p5FJovvTX+YuRg4ONgEtiTXt8SANIgLKEn8nrmIEqWEW6GGUaPnXzASSEBawkvjxYzXYBhYB VYlzS7+CxXkFXCQeNc5ggdgmJ3HzXCfzBEbuBYwMqxhFUkuLc9Nzi430ihNzi0vz0vWS83M3 MQKDctuxn1t2MHa9Cz7EKMDBqMTDeyN/VqQQa2JZcWXuIUYJDmYlEd5dC4FCvCmJlVWpRfnx RaU5qcWHGE2Blk9klhJNzgdGTF5JvKGJobmloZGxhYW5kZGSOK/65aZIIYH0xJLU7NTUgtQi mD4mDk6pBsY+azWd86bnNyp82OIqx8DCeminwEz/4knpxyaEWJ44su799ok1Wtkvr4f7zTXn FRNqmWZ75ijLJpbA2W2fdApjJ6joVbbx8sxeynnAJvHGKYajbhN+sF9hWJHTJWmvePjA1aDl xQ1z7mp99JDZrJTx9o0yF6PYqitlK3V4tWdMel1xe7Lpxc9KLMUZiYZazEXFiQCo8GD7YAIA AA== X-MTR: 20000000000000000@CPGS X-CMS-MailID: 20170821103306eucas1p204dcad5c21e623af92859b61ad2528f3 X-Msg-Generator: CA X-Sender-IP: 182.198.249.180 X-Local-Sender: =?UTF-8?B?TWFjaWVqIFB1cnNraRtTZWN1cml0eSAoVFApG1NhbXN1bmcg?= =?UTF-8?B?RWxlY3Ryb25pY3MbVHJhaW5lZSAoKQ==?= X-Global-Sender: =?UTF-8?B?TWFjaWVqIFB1cnNraRtTZWN1cml0eSAoVFApG1NhbXN1bmcg?= =?UTF-8?B?RWxlY3Ryb25pY3MbVHJhaW5lZSAoKQ==?= X-Sender-Code: =?UTF-8?B?QzEwG0VIURtDMTBDRDAyQ0QwMjczOTU=?= CMS-TYPE: 201P X-CMS-RootMailID: 20170821103306eucas1p204dcad5c21e623af92859b61ad2528f3 X-RootMTR: 20170821103306eucas1p204dcad5c21e623af92859b61ad2528f3 References: Cc: Laurent.pinchart@ideasonboard.com, Maciej Purski X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP Function sii8620_mt_read_devcap_reg_recv() used to read array index from a wrong msg register, which caused writing out of array bounds. It led to writing on other fields of struct sii8620. Signed-off-by: Maciej Purski Fixes: e9c6da270 ("drm/bridge/sii8620: add reading device capability registers") --- drivers/gpu/drm/bridge/sil-sii8620.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c index 2d51a22..5131bfb 100644 --- a/drivers/gpu/drm/bridge/sil-sii8620.c +++ b/drivers/gpu/drm/bridge/sil-sii8620.c @@ -597,9 +597,9 @@ static void sii8620_mt_read_devcap(struct sii8620 *ctx, bool xdevcap) static void sii8620_mt_read_devcap_reg_recv(struct sii8620 *ctx, struct sii8620_mt_msg *msg) { - u8 reg = msg->reg[0] & 0x7f; + u8 reg = msg->reg[1] & 0x7f; - if (msg->reg[0] & 0x80) + if (msg->reg[1] & 0x80) ctx->xdevcap[reg] = msg->ret; else ctx->devcap[reg] = msg->ret;