Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7c7e10db authored by Ville Syrjälä's avatar Ville Syrjälä Committed by Daniel Vetter
Browse files

drm/i915: Make hpd arrays big enough to avoid out of bounds access 



intel_hpd_irq_handler() walks the passed in hpd[] array assuming it
contains HPD_NUM_PINS elements. Currently that's not true as we don't
specify an explicit size for the arrays when initializing them. Avoid
the out of bounds accesses by specifying the size for the arrays.

Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: default avatarJani Nikula <jani.nikula@intel.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
parent e85a5c79

drivers/gpu/drm/i915/i915_irq.c

+6 −6
Original line number Diff line number Diff line
@@ -45,7 +45,7 @@ 
 * and related files, but that will be described in separate chapters.

 */



static const u32 hpd_ibx[] = {

static const u32 hpd_ibx[HPD_NUM_PINS] = {

	[HPD_CRT] = SDE_CRT_HOTPLUG,

	[HPD_SDVO_B] = SDE_SDVOB_HOTPLUG,

	[HPD_PORT_B] = SDE_PORTB_HOTPLUG,
@@ -53,7 +53,7 @@ static const u32 hpd_ibx[] = { 
	[HPD_PORT_D] = SDE_PORTD_HOTPLUG

};



static const u32 hpd_cpt[] = {

static const u32 hpd_cpt[HPD_NUM_PINS] = {

	[HPD_CRT] = SDE_CRT_HOTPLUG_CPT,

	[HPD_SDVO_B] = SDE_SDVOB_HOTPLUG_CPT,

	[HPD_PORT_B] = SDE_PORTB_HOTPLUG_CPT,
@@ -61,7 +61,7 @@ static const u32 hpd_cpt[] = { 
	[HPD_PORT_D] = SDE_PORTD_HOTPLUG_CPT

};



static const u32 hpd_mask_i915[] = {

static const u32 hpd_mask_i915[HPD_NUM_PINS] = {

	[HPD_CRT] = CRT_HOTPLUG_INT_EN,

	[HPD_SDVO_B] = SDVOB_HOTPLUG_INT_EN,

	[HPD_SDVO_C] = SDVOC_HOTPLUG_INT_EN,
@@ -70,7 +70,7 @@ static const u32 hpd_mask_i915[] = { 
	[HPD_PORT_D] = PORTD_HOTPLUG_INT_EN

};



static const u32 hpd_status_g4x[] = {

static const u32 hpd_status_g4x[HPD_NUM_PINS] = {

	[HPD_CRT] = CRT_HOTPLUG_INT_STATUS,

	[HPD_SDVO_B] = SDVOB_HOTPLUG_INT_STATUS_G4X,

	[HPD_SDVO_C] = SDVOC_HOTPLUG_INT_STATUS_G4X,
@@ -79,7 +79,7 @@ static const u32 hpd_status_g4x[] = { 
	[HPD_PORT_D] = PORTD_HOTPLUG_INT_STATUS

};



static const u32 hpd_status_i915[] = { /* i915 and valleyview are the same */

static const u32 hpd_status_i915[HPD_NUM_PINS] = { /* i915 and valleyview are the same */

	[HPD_CRT] = CRT_HOTPLUG_INT_STATUS,

	[HPD_SDVO_B] = SDVOB_HOTPLUG_INT_STATUS_I915,

	[HPD_SDVO_C] = SDVOC_HOTPLUG_INT_STATUS_I915,
@@ -1506,7 +1506,7 @@ static inline enum port get_port_from_pin(enum hpd_pin pin) 
static inline void intel_hpd_irq_handler(struct drm_device *dev,

					 u32 hotplug_trigger,

					 u32 dig_hotplug_reg,

					 const u32 *hpd)

					 const u32 hpd[HPD_NUM_PINS])

{

	struct drm_i915_private *dev_priv = dev->dev_private;

	int i;