| Message ID | 20191212091130.zf2g53njf5u24wk6@kili.mountain (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/i915/bios: fix off by one in parse_generic_dtd() | expand |
On Thu, Dec 12, 2019 at 12:11:30PM +0300, Dan Carpenter wrote: > The "num_dtd" variable is the number of elements in the > generic_dtd->dtd[] array so the > needs to be >= to prevent reading one > element beyond the end of the array. > > Fixes: 33ef6d4fd8df ("drm/i915/vbt: Handle generic DTD block") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Matt Roper <matthew.d.roper@intel.com> > --- > drivers/gpu/drm/i915/display/intel_bios.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c > index 1aeecdd02293..d1e27ee86e53 100644 > --- a/drivers/gpu/drm/i915/display/intel_bios.c > +++ b/drivers/gpu/drm/i915/display/intel_bios.c > @@ -338,7 +338,7 @@ parse_generic_dtd(struct drm_i915_private *dev_priv, > > num_dtd = (get_blocksize(generic_dtd) - > sizeof(struct bdb_generic_dtd)) / generic_dtd->gdtd_size; > - if (dev_priv->vbt.panel_type > num_dtd) { > + if (dev_priv->vbt.panel_type >= num_dtd) { > DRM_ERROR("Panel type %d not found in table of %d DTD's\n", > dev_priv->vbt.panel_type, num_dtd); > return; > -- > 2.11.0 >
On Thu, 12 Dec 2019, Matt Roper <matthew.d.roper@intel.com> wrote: > On Thu, Dec 12, 2019 at 12:11:30PM +0300, Dan Carpenter wrote: >> The "num_dtd" variable is the number of elements in the >> generic_dtd->dtd[] array so the > needs to be >= to prevent reading one >> element beyond the end of the array. >> >> Fixes: 33ef6d4fd8df ("drm/i915/vbt: Handle generic DTD block") >> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Pushed to drm-intel-next-queued, thanks for the patch and review. BR, Jani. > >> --- >> drivers/gpu/drm/i915/display/intel_bios.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c >> index 1aeecdd02293..d1e27ee86e53 100644 >> --- a/drivers/gpu/drm/i915/display/intel_bios.c >> +++ b/drivers/gpu/drm/i915/display/intel_bios.c >> @@ -338,7 +338,7 @@ parse_generic_dtd(struct drm_i915_private *dev_priv, >> >> num_dtd = (get_blocksize(generic_dtd) - >> sizeof(struct bdb_generic_dtd)) / generic_dtd->gdtd_size; >> - if (dev_priv->vbt.panel_type > num_dtd) { >> + if (dev_priv->vbt.panel_type >= num_dtd) { >> DRM_ERROR("Panel type %d not found in table of %d DTD's\n", >> dev_priv->vbt.panel_type, num_dtd); >> return; >> -- >> 2.11.0 >>
diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c index 1aeecdd02293..d1e27ee86e53 100644 --- a/drivers/gpu/drm/i915/display/intel_bios.c +++ b/drivers/gpu/drm/i915/display/intel_bios.c @@ -338,7 +338,7 @@ parse_generic_dtd(struct drm_i915_private *dev_priv, num_dtd = (get_blocksize(generic_dtd) - sizeof(struct bdb_generic_dtd)) / generic_dtd->gdtd_size; - if (dev_priv->vbt.panel_type > num_dtd) { + if (dev_priv->vbt.panel_type >= num_dtd) { DRM_ERROR("Panel type %d not found in table of %d DTD's\n", dev_priv->vbt.panel_type, num_dtd); return;
The "num_dtd" variable is the number of elements in the generic_dtd->dtd[] array so the > needs to be >= to prevent reading one element beyond the end of the array. Fixes: 33ef6d4fd8df ("drm/i915/vbt: Handle generic DTD block") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/gpu/drm/i915/display/intel_bios.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)