diff options
author | Alex Deucher <alexdeucher@gmail.com> | 2010-04-01 15:08:47 -0400 |
---|---|---|
committer | Dave Airlie <airlied@redhat.com> | 2010-04-05 19:59:31 -0400 |
commit | 95beb690170e6ce918fe53c73a0fcc7cf64d704a (patch) | |
tree | 1cca4412c25bf1ef69409d1ddeccbc2e21bccc66 /drivers/gpu/drm | |
parent | 57b54ea6b7863ccfeb41851b5f58f9fd1b83c79e (diff) |
drm/radeon/kms/atom: fix gpio i2c table overrun (v2)
The GPIO_I2C_INFO table does not always have
ATOM_MAX_SUPPORTED_DEVICE entries. Limit
the number of indices to the size of the
table.
Should fix Novell bug 589022.
v2: fix typo
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc: Stable <stable@kernel.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm')
-rw-r--r-- | drivers/gpu/drm/radeon/radeon_atombios.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c index 1fff95505cf5..5673665ff216 100644 --- a/drivers/gpu/drm/radeon/radeon_atombios.c +++ b/drivers/gpu/drm/radeon/radeon_atombios.c | |||
@@ -69,16 +69,19 @@ static inline struct radeon_i2c_bus_rec radeon_lookup_i2c_gpio(struct radeon_dev | |||
69 | struct radeon_i2c_bus_rec i2c; | 69 | struct radeon_i2c_bus_rec i2c; |
70 | int index = GetIndexIntoMasterTable(DATA, GPIO_I2C_Info); | 70 | int index = GetIndexIntoMasterTable(DATA, GPIO_I2C_Info); |
71 | struct _ATOM_GPIO_I2C_INFO *i2c_info; | 71 | struct _ATOM_GPIO_I2C_INFO *i2c_info; |
72 | uint16_t data_offset; | 72 | uint16_t data_offset, size; |
73 | int i; | 73 | int i, num_indices; |
74 | 74 | ||
75 | memset(&i2c, 0, sizeof(struct radeon_i2c_bus_rec)); | 75 | memset(&i2c, 0, sizeof(struct radeon_i2c_bus_rec)); |
76 | i2c.valid = false; | 76 | i2c.valid = false; |
77 | 77 | ||
78 | if (atom_parse_data_header(ctx, index, NULL, NULL, NULL, &data_offset)) { | 78 | if (atom_parse_data_header(ctx, index, &size, NULL, NULL, &data_offset)) { |
79 | i2c_info = (struct _ATOM_GPIO_I2C_INFO *)(ctx->bios + data_offset); | 79 | i2c_info = (struct _ATOM_GPIO_I2C_INFO *)(ctx->bios + data_offset); |
80 | 80 | ||
81 | for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) { | 81 | num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) / |
82 | sizeof(ATOM_GPIO_I2C_ASSIGMENT); | ||
83 | |||
84 | for (i = 0; i < num_indices; i++) { | ||
82 | gpio = &i2c_info->asGPIO_Info[i]; | 85 | gpio = &i2c_info->asGPIO_Info[i]; |
83 | 86 | ||
84 | if (gpio->sucI2cId.ucAccess == id) { | 87 | if (gpio->sucI2cId.ucAccess == id) { |