projects
/
openwrt
/
staging
/
blogic.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
949d0b5
)
drm/i915/dsi: defend gpio table against out of bounds access
author
Jani Nikula
<jani.nikula@intel.com>
Thu, 4 Feb 2016 10:50:49 +0000
(12:50 +0200)
committer
Jani Nikula
<jani.nikula@intel.com>
Mon, 8 Feb 2016 09:33:43 +0000
(11:33 +0200)
Do not blindly trust the VBT data used for indexing.
Cc: stable@vger.kernel.org
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link:
http://patchwork.freedesktop.org/patch/msgid/cc32d40c2b47f2d2151811855ac2c3dabab1d57d.1454582914.git.jani.nikula@intel.com
(cherry picked from commit
5d2d0a12d3d08bf50434f0b5947bb73bac04b941
)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
patch
|
blob
|
history
diff --git
a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
index a5e99ac305daab3ef69471d37b0ec9a97a27425c..349775e88e5b9504ff456064a1fc9f5f84e19d7e 100644
(file)
--- a/
drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
+++ b/
drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
@@
-209,6
+209,11
@@
static const u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, const u8 *data)
/* pull up/down */
action = *data++;
+ if (gpio >= ARRAY_SIZE(gtable)) {
+ DRM_DEBUG_KMS("unknown gpio %u\n", gpio);
+ goto out;
+ }
+
function = gtable[gpio].function_reg;
pad = gtable[gpio].pad_reg;
@@
-226,6
+231,7
@@
static const u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, const u8 *data)
vlv_gpio_nc_write(dev_priv, pad, val);
mutex_unlock(&dev_priv->sb_lock);
+out:
return data;
}