hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

drm/radeon: fix handling of v6 power tables 

The code was mis-handling variable sized arrays.

Reported-by: Sylvain BERTRAND <sylware@legeek.net>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
This commit is contained in:
Alex Deucher 2013-05-01 14:34:54 -04:00
parent 982cb32918
commit 441e76ca83
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/gpu/drm/radeon/radeon_atombios.c
View File

@ -2518,6 +2518,7 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
int index = GetIndexIntoMasterTable(DATA, PowerPlayInfo); int index = GetIndexIntoMasterTable(DATA, PowerPlayInfo);
u16 data_offset; u16 data_offset;
u8 frev, crev; u8 frev, crev;
u8 *power_state_offset;
if (!atom_parse_data_header(mode_info->atom_context, index, NULL, if (!atom_parse_data_header(mode_info->atom_context, index, NULL,
&frev, &crev, &data_offset)) &frev, &crev, &data_offset))
@ -2540,11 +2541,11 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
state_array->ucNumEntries, GFP_KERNEL); state_array->ucNumEntries, GFP_KERNEL);
if (!rdev->pm.power_state) if (!rdev->pm.power_state)
return state_index; return state_index;
power_state_offset = (u8 *)state_array->states;
for (i = 0; i < state_array->ucNumEntries; i++) { for (i = 0; i < state_array->ucNumEntries; i++) {
mode_index = 0; mode_index = 0;
power_state = (union pplib_power_state *)&state_array->states[i]; power_state = (union pplib_power_state *)power_state_offset;
/* XXX this might be an inagua bug... */ non_clock_array_index = power_state->v2.nonClockInfoIndex;
non_clock_array_index = i; /* power_state->v2.nonClockInfoIndex */
non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
&non_clock_info_array->nonClockInfo[non_clock_array_index]; &non_clock_info_array->nonClockInfo[non_clock_array_index];
rdev->pm.power_state[i].clock_info = kzalloc(sizeof(struct radeon_pm_clock_info) * rdev->pm.power_state[i].clock_info = kzalloc(sizeof(struct radeon_pm_clock_info) *
@ -2556,9 +2557,6 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
if (power_state->v2.ucNumDPMLevels) { if (power_state->v2.ucNumDPMLevels) {
for (j = 0; j < power_state->v2.ucNumDPMLevels; j++) { for (j = 0; j < power_state->v2.ucNumDPMLevels; j++) {
clock_array_index = power_state->v2.clockInfoIndex[j]; clock_array_index = power_state->v2.clockInfoIndex[j];
/* XXX this might be an inagua bug... */
if (clock_array_index >= clock_info_array->ucNumEntries)
continue;
clock_info = (union pplib_clock_info *) clock_info = (union pplib_clock_info *)
&clock_info_array->clockInfo[clock_array_index * clock_info_array->ucEntrySize]; &clock_info_array->clockInfo[clock_array_index * clock_info_array->ucEntrySize];
valid = radeon_atombios_parse_pplib_clock_info(rdev, valid = radeon_atombios_parse_pplib_clock_info(rdev,
@ -2580,6 +2578,7 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
non_clock_info); non_clock_info);
state_index++; state_index++;
} }
power_state_offset += 2 + power_state->v2.ucNumDPMLevels;
} }
/* if multiple clock modes, mark the lowest as no display */ /* if multiple clock modes, mark the lowest as no display */
for (i = 0; i < state_index; i++) { for (i = 0; i < state_index; i++) {