|
Takashi Iwai |
aa3869 |
From d116db180decec1b21bba31d2ff495ac4d8e1b83 Mon Sep 17 00:00:00 2001
|
|
Takashi Iwai |
aa3869 |
From: Mario Limonciello <mario.limonciello@amd.com>
|
|
Takashi Iwai |
aa3869 |
Date: Thu, 23 Mar 2023 14:07:06 -0500
|
|
Takashi Iwai |
aa3869 |
Subject: [PATCH] drm/amd: Fix an out of bounds error in BIOS parser
|
|
Takashi Iwai |
aa3869 |
Git-commit: d116db180decec1b21bba31d2ff495ac4d8e1b83
|
|
Takashi Iwai |
aa3869 |
Patch-mainline: v6.4-rc1
|
|
Takashi Iwai |
aa3869 |
References: git-fixes
|
|
Takashi Iwai |
aa3869 |
|
|
Takashi Iwai |
aa3869 |
The array is hardcoded to 8 in atomfirmware.h, but firmware provides
|
|
Takashi Iwai |
aa3869 |
a bigger one sometimes. Deferencing the larger array causes an out
|
|
Takashi Iwai |
aa3869 |
of bounds error.
|
|
Takashi Iwai |
aa3869 |
|
|
Takashi Iwai |
aa3869 |
commit 4fc1ba4aa589 ("drm/amd/display: fix array index out of bound error
|
|
Takashi Iwai |
aa3869 |
in bios parser") fixed some of this, but there are two other cases
|
|
Takashi Iwai |
aa3869 |
not covered by it. Fix those as well.
|
|
Takashi Iwai |
aa3869 |
|
|
Takashi Iwai |
aa3869 |
Reported-by: erhard_f@mailbox.org
|
|
Takashi Iwai |
aa3869 |
Link: https://bugzilla.kernel.org/show_bug.cgi?id=214853
|
|
Takashi Iwai |
aa3869 |
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2473
|
|
Takashi Iwai |
aa3869 |
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
|
|
Takashi Iwai |
aa3869 |
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
|
|
Takashi Iwai |
aa3869 |
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Takashi Iwai |
aa3869 |
Acked-by: Takashi Iwai <tiwai@suse.de>
|
|
Takashi Iwai |
aa3869 |
|
|
Takashi Iwai |
aa3869 |
---
|
|
Takashi Iwai |
aa3869 |
drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 7 ++-----
|
|
Takashi Iwai |
aa3869 |
1 file changed, 2 insertions(+), 5 deletions(-)
|
|
Takashi Iwai |
aa3869 |
|
|
Takashi Iwai |
aa3869 |
diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
|
|
Takashi Iwai |
aa3869 |
index f0f948501e9a..cce47d3f1a13 100644
|
|
Takashi Iwai |
aa3869 |
--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
|
|
Takashi Iwai |
aa3869 |
+++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
|
|
Takashi Iwai |
aa3869 |
@@ -515,11 +515,8 @@ static enum bp_result get_gpio_i2c_info(
|
|
Takashi Iwai |
aa3869 |
info->i2c_slave_address = record->i2c_slave_addr;
|
|
Takashi Iwai |
aa3869 |
|
|
Takashi Iwai |
aa3869 |
/* TODO: check how to get register offset for en, Y, etc. */
|
|
Takashi Iwai |
aa3869 |
- info->gpio_info.clk_a_register_index =
|
|
Takashi Iwai |
aa3869 |
- le16_to_cpu(
|
|
Takashi Iwai |
aa3869 |
- header->gpio_pin[table_index].data_a_reg_index);
|
|
Takashi Iwai |
aa3869 |
- info->gpio_info.clk_a_shift =
|
|
Takashi Iwai |
aa3869 |
- header->gpio_pin[table_index].gpio_bitshift;
|
|
Takashi Iwai |
aa3869 |
+ info->gpio_info.clk_a_register_index = le16_to_cpu(pin->data_a_reg_index);
|
|
Takashi Iwai |
aa3869 |
+ info->gpio_info.clk_a_shift = pin->gpio_bitshift;
|
|
Takashi Iwai |
aa3869 |
|
|
Takashi Iwai |
aa3869 |
return BP_RESULT_OK;
|
|
Takashi Iwai |
aa3869 |
}
|
|
Takashi Iwai |
aa3869 |
--
|
|
Takashi Iwai |
aa3869 |
2.35.3
|
|
Takashi Iwai |
aa3869 |
|