* [PATCH] drm/bridge/sii8620: Fix memory corruption
[not found] <CGME20170821103306eucas1p204dcad5c21e623af92859b61ad2528f3@eucas1p2.samsung.com>
@ 2017-08-21 10:32 ` Maciej Purski
2017-08-24 17:28 ` Andrzej Hajda
0 siblings, 1 reply; 2+ messages in thread
From: Maciej Purski @ 2017-08-21 10:32 UTC (permalink / raw)
To: dri-devel; +Cc: Laurent.pinchart, Maciej Purski
Function sii8620_mt_read_devcap_reg_recv() used to read array index
from a wrong msg register, which caused writing out of array
bounds. It led to writing on other fields of struct sii8620.
Signed-off-by: Maciej Purski <m.purski@samsung.com>
Fixes: e9c6da270 ("drm/bridge/sii8620: add reading device capability
registers")
---
drivers/gpu/drm/bridge/sil-sii8620.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
index 2d51a22..5131bfb 100644
--- a/drivers/gpu/drm/bridge/sil-sii8620.c
+++ b/drivers/gpu/drm/bridge/sil-sii8620.c
@@ -597,9 +597,9 @@ static void sii8620_mt_read_devcap(struct sii8620 *ctx, bool xdevcap)
static void sii8620_mt_read_devcap_reg_recv(struct sii8620 *ctx,
struct sii8620_mt_msg *msg)
{
- u8 reg = msg->reg[0] & 0x7f;
+ u8 reg = msg->reg[1] & 0x7f;
- if (msg->reg[0] & 0x80)
+ if (msg->reg[1] & 0x80)
ctx->xdevcap[reg] = msg->ret;
else
ctx->devcap[reg] = msg->ret;
--
2.7.4
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] drm/bridge/sii8620: Fix memory corruption
2017-08-21 10:32 ` [PATCH] drm/bridge/sii8620: Fix memory corruption Maciej Purski
@ 2017-08-24 17:28 ` Andrzej Hajda
0 siblings, 0 replies; 2+ messages in thread
From: Andrzej Hajda @ 2017-08-24 17:28 UTC (permalink / raw)
To: Maciej Purski, dri-devel; +Cc: Laurent.pinchart
On 21.08.2017 12:32, Maciej Purski wrote:
> Function sii8620_mt_read_devcap_reg_recv() used to read array index
> from a wrong msg register, which caused writing out of array
> bounds. It led to writing on other fields of struct sii8620.
>
> Signed-off-by: Maciej Purski <m.purski@samsung.com>
> Fixes: e9c6da270 ("drm/bridge/sii8620: add reading device capability
> registers")
> ---
Queued to drm-misc-fixes.
Regards
Andrzej
> drivers/gpu/drm/bridge/sil-sii8620.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
> index 2d51a22..5131bfb 100644
> --- a/drivers/gpu/drm/bridge/sil-sii8620.c
> +++ b/drivers/gpu/drm/bridge/sil-sii8620.c
> @@ -597,9 +597,9 @@ static void sii8620_mt_read_devcap(struct sii8620 *ctx, bool xdevcap)
> static void sii8620_mt_read_devcap_reg_recv(struct sii8620 *ctx,
> struct sii8620_mt_msg *msg)
> {
> - u8 reg = msg->reg[0] & 0x7f;
> + u8 reg = msg->reg[1] & 0x7f;
>
> - if (msg->reg[0] & 0x80)
> + if (msg->reg[1] & 0x80)
> ctx->xdevcap[reg] = msg->ret;
> else
> ctx->devcap[reg] = msg->ret;
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-08-24 17:29 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CGME20170821103306eucas1p204dcad5c21e623af92859b61ad2528f3@eucas1p2.samsung.com>
2017-08-21 10:32 ` [PATCH] drm/bridge/sii8620: Fix memory corruption Maciej Purski
2017-08-24 17:28 ` Andrzej Hajda
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).