diff options
| author | Maciej Purski <m.purski@samsung.com> | 2017-08-21 12:32:51 +0200 |
|---|---|---|
| committer | Andrzej Hajda <a.hajda@samsung.com> | 2017-08-24 19:06:32 +0200 |
| commit | 79964dbaf662229253b281c42e82e2675a9d3b80 (patch) | |
| tree | a8cffc0f30666eb06ef4a4c077ed8d15fcaafcda | |
| parent | fe4600a548f2763dec91b3b27a1245c370ceee2a (diff) | |
drm/bridge/sii8620: Fix memory corruptiondrm-misc-fixes-2017-08-28
Function sii8620_mt_read_devcap_reg_recv() used to read array index
from a wrong msg register, which caused writing out of array
bounds. It led to writing on other fields of struct sii8620.
Signed-off-by: Maciej Purski <m.purski@samsung.com>
Fixes: e9c6da270 ("drm/bridge/sii8620: add reading device capability
registers")
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1503311571-25819-1-git-send-email-m.purski@samsung.com
| -rw-r--r-- | drivers/gpu/drm/bridge/sil-sii8620.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c index 2d51a2269fc6..5131bfb94f06 100644 --- a/drivers/gpu/drm/bridge/sil-sii8620.c +++ b/drivers/gpu/drm/bridge/sil-sii8620.c @@ -597,9 +597,9 @@ static void sii8620_mt_read_devcap(struct sii8620 *ctx, bool xdevcap) static void sii8620_mt_read_devcap_reg_recv(struct sii8620 *ctx, struct sii8620_mt_msg *msg) { - u8 reg = msg->reg[0] & 0x7f; + u8 reg = msg->reg[1] & 0x7f; - if (msg->reg[0] & 0x80) + if (msg->reg[1] & 0x80) ctx->xdevcap[reg] = msg->ret; else ctx->devcap[reg] = msg->ret; |