aboutsummaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorAlex Deucher <alexdeucher@gmail.com>2010-04-01 19:08:47 +0000
committerDave Airlie <airlied@redhat.com>2010-04-06 09:59:31 +1000
commit95beb690170e6ce918fe53c73a0fcc7cf64d704a (patch)
tree1cca4412c25bf1ef69409d1ddeccbc2e21bccc66 /drivers
parent57b54ea6b7863ccfeb41851b5f58f9fd1b83c79e (diff)
drm/radeon/kms/atom: fix gpio i2c table overrun (v2)
The GPIO_I2C_INFO table does not always have ATOM_MAX_SUPPORTED_DEVICE entries. Limit the number of indices to the size of the table. Should fix Novell bug 589022. v2: fix typo Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Cc: Stable <stable@kernel.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/gpu/drm/radeon/radeon_atombios.c11
1 files changed, 7 insertions, 4 deletions
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 1fff95505cf..5673665ff21 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -69,16 +69,19 @@ static inline struct radeon_i2c_bus_rec radeon_lookup_i2c_gpio(struct radeon_dev
struct radeon_i2c_bus_rec i2c;
int index = GetIndexIntoMasterTable(DATA, GPIO_I2C_Info);
struct _ATOM_GPIO_I2C_INFO *i2c_info;
- uint16_t data_offset;
- int i;
+ uint16_t data_offset, size;
+ int i, num_indices;
memset(&i2c, 0, sizeof(struct radeon_i2c_bus_rec));
i2c.valid = false;
- if (atom_parse_data_header(ctx, index, NULL, NULL, NULL, &data_offset)) {
+ if (atom_parse_data_header(ctx, index, &size, NULL, NULL, &data_offset)) {
i2c_info = (struct _ATOM_GPIO_I2C_INFO *)(ctx->bios + data_offset);
- for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) {
+ num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
+ sizeof(ATOM_GPIO_I2C_ASSIGMENT);
+
+ for (i = 0; i < num_indices; i++) {
gpio = &i2c_info->asGPIO_Info[i];
if (gpio->sucI2cId.ucAccess == id) {