From patchwork Thu Apr 1 16:57:21 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alex Deucher X-Patchwork-Id: 90181 Received: from lists.sourceforge.net (lists.sourceforge.net [216.34.181.88]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o31GwhVi022099 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 1 Apr 2010 16:59:20 GMT Received: from localhost ([127.0.0.1] helo=sfs-ml-3.v29.ch3.sourceforge.com) by sfs-ml-3.v29.ch3.sourceforge.com with esmtp (Exim 4.69) (envelope-from ) id 1NxNhz-0003f5-0j; Thu, 01 Apr 2010 16:57:31 +0000 Received: from sfi-mx-2.v28.ch3.sourceforge.com ([172.29.28.122] helo=mx.sourceforge.net) by sfs-ml-3.v29.ch3.sourceforge.com with esmtp (Exim 4.69) (envelope-from ) id 1NxNhy-0003eq-3Z for dri-devel@lists.sourceforge.net; Thu, 01 Apr 2010 16:57:30 +0000 Received-SPF: pass (sfi-mx-2.v28.ch3.sourceforge.com: domain of gmail.com designates 209.85.220.212 as permitted sender) client-ip=209.85.220.212; envelope-from=alexdeucher@gmail.com; helo=mail-fx0-f212.google.com; Received: from mail-fx0-f212.google.com ([209.85.220.212]) by sfi-mx-2.v28.ch3.sourceforge.com with esmtp (Exim 4.69) id 1NxNhv-0006on-Vf for dri-devel@lists.sourceforge.net; Thu, 01 Apr 2010 16:57:30 +0000 Received: by fxm4 with SMTP id 4so103383fxm.6 for ; Thu, 01 Apr 2010 09:57:22 -0700 (PDT) MIME-Version: 1.0 Received: by 10.223.108.19 with HTTP; Thu, 1 Apr 2010 09:57:21 -0700 (PDT) Date: Thu, 1 Apr 2010 12:57:21 -0400 Received: by 10.223.5.70 with SMTP id 6mr944712fau.18.1270141041727; Thu, 01 Apr 2010 09:57:21 -0700 (PDT) Message-ID: Subject: [PATCH] drm/radeon/kms/atom: fix gpio i2c table overrun From: Alex Deucher To: Dave Airlie , DRI Development Mailing List X-Spam-Score: -1.2 (-) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for sender-domain -0.0 SPF_PASS SPF: sender matches SPF record -0.0 DKIM_VERIFIED Domain Keys Identified Mail: signature passes verification 0.0 DKIM_SIGNED Domain Keys Identified Mail: message has a signature 0.3 AWL AWL: From: address is in the auto white-list X-Headers-End: 1NxNhv-0006on-Vf X-BeenThere: dri-devel@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.sourceforge.net X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Thu, 01 Apr 2010 16:59:22 +0000 (UTC) diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c index b969eda..bb37da4 100644 --- a/drivers/gpu/drm/radeon/radeon_atombios.c +++ b/drivers/gpu/drm/radeon/radeon_atombios.c @@ -69,16 +69,19 @@ static inline struct radeon_i2c_bus_rec radeon_lookup_i2c_gpio(struct radeon_dev struct radeon_i2c_bus_rec i2c; int index = GetIndexIntoMasterTable(DATA, GPIO_I2C_Info); struct _ATOM_GPIO_I2C_INFO *i2c_info; - uint16_t data_offset; - int i; + uint16_t data_offset, size; + int i, num_indices; memset(&i2c, 0, sizeof(struct radeon_i2c_bus_rec)); i2c.valid = false; - if (atom_parse_data_header(ctx, index, NULL, NULL, NULL, &data_offset)) { + if (atom_parse_data_header(ctx, index, &size, NULL, NULL, &data_offset)) { i2c_info = (struct _ATOM_GPIO_I2C_INFO *)(ctx->bios + data_offset); - for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) { + num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) / + sizeof(ATOM_GPIO_I2C_INFO); + + for (i = 0; i < num_indices; i++) { gpio = &i2c_info->asGPIO_Info[i];