From patchwork Thu Apr 1 19:08:47 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alex Deucher X-Patchwork-Id: 90248 Received: from lists.sourceforge.net (lists.sourceforge.net [216.34.181.88]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o31JAB44015991 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 1 Apr 2010 19:10:48 GMT Received: from localhost ([127.0.0.1] helo=sfs-ml-3.v29.ch3.sourceforge.com) by sfs-ml-3.v29.ch3.sourceforge.com with esmtp (Exim 4.69) (envelope-from ) id 1NxPl9-0002Oz-H1; Thu, 01 Apr 2010 19:08:55 +0000 Received: from sfi-mx-3.v28.ch3.sourceforge.com ([172.29.28.123] helo=mx.sourceforge.net) by sfs-ml-3.v29.ch3.sourceforge.com with esmtp (Exim 4.69) (envelope-from ) id 1NxPl8-0002Oq-8e for dri-devel@lists.sourceforge.net; Thu, 01 Apr 2010 19:08:54 +0000 Received-SPF: pass (sfi-mx-3.v28.ch3.sourceforge.com: domain of gmail.com designates 74.125.82.175 as permitted sender) client-ip=74.125.82.175; envelope-from=alexdeucher@gmail.com; helo=mail-wy0-f175.google.com; Received: from mail-wy0-f175.google.com ([74.125.82.175]) by sfi-mx-3.v28.ch3.sourceforge.com with esmtp (Exim 4.69) id 1NxPl7-0003UH-6H for dri-devel@lists.sourceforge.net; Thu, 01 Apr 2010 19:08:54 +0000 Received: by wyf23 with SMTP id 23so390921wyf.34 for ; Thu, 01 Apr 2010 12:08:47 -0700 (PDT) MIME-Version: 1.0 Received: by 10.216.51.75 with HTTP; Thu, 1 Apr 2010 12:08:47 -0700 (PDT) In-Reply-To: References: Date: Thu, 1 Apr 2010 15:08:47 -0400 Received: by 10.216.91.16 with SMTP id g16mr632352wef.102.1270148927287; Thu, 01 Apr 2010 12:08:47 -0700 (PDT) Message-ID: Subject: Re: [PATCH] drm/radeon/kms/atom: fix gpio i2c table overrun From: Alex Deucher To: Dave Airlie , DRI Development Mailing List X-Spam-Score: -1.1 (-) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for sender-domain -0.0 SPF_PASS SPF: sender matches SPF record -0.0 DKIM_VERIFIED Domain Keys Identified Mail: signature passes verification 0.0 DKIM_SIGNED Domain Keys Identified Mail: message has a signature 0.4 AWL AWL: From: address is in the auto white-list X-Headers-End: 1NxPl7-0003UH-6H X-BeenThere: dri-devel@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.sourceforge.net X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Thu, 01 Apr 2010 19:10:48 +0000 (UTC) diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c index b969eda..2730199 100644 --- a/drivers/gpu/drm/radeon/radeon_atombios.c +++ b/drivers/gpu/drm/radeon/radeon_atombios.c @@ -69,16 +69,19 @@ static inline struct radeon_i2c_bus_rec radeon_lookup_i2c_gpio(struct radeon_dev struct radeon_i2c_bus_rec i2c; int index = GetIndexIntoMasterTable(DATA, GPIO_I2C_Info); struct _ATOM_GPIO_I2C_INFO *i2c_info; - uint16_t data_offset; - int i; + uint16_t data_offset, size; + int i, num_indices; memset(&i2c, 0, sizeof(struct radeon_i2c_bus_rec)); i2c.valid = false; - if (atom_parse_data_header(ctx, index, NULL, NULL, NULL, &data_offset)) { + if (atom_parse_data_header(ctx, index, &size, NULL, NULL, &data_offset)) { i2c_info = (struct _ATOM_GPIO_I2C_INFO *)(ctx->bios + data_offset); - for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) { + num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) / + sizeof(ATOM_GPIO_I2C_ASSIGMENT); + + for (i = 0; i < num_indices; i++) { gpio = &i2c_info->asGPIO_Info[i];