diff options
| author | Alex Deucher <alexander.deucher@amd.com> | 2013-08-27 20:36:01 +0400 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2013-08-31 00:31:10 +0400 |
| commit | fb93df1c2d8b3b1fb16d6ee9e32554e0c038815d (patch) | |
| tree | 2a5e0d1342df685ec93851d3b6d683058a2ed9a3 /drivers/gpu/drm/radeon/radeon_atombios.c | |
| parent | acf88deb8ddbb73acd1c3fa32fde51af9153227f (diff) | |
| download | linux-fb93df1c2d8b3b1fb16d6ee9e32554e0c038815d.tar.xz | |
drm/radeon: fix handling of variable sized arrays for router objects
The table has the following format:
typedef struct _ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT //usSrcDstTableOffset pointing to this structure
{
UCHAR ucNumberOfSrc;
USHORT usSrcObjectID[1];
UCHAR ucNumberOfDst;
USHORT usDstObjectID[1];
}ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT;
usSrcObjectID[] and usDstObjectID[] are variably sized, so we
can't access them directly. Use pointers and update the offset
appropriately when accessing the Dst members.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Diffstat (limited to 'drivers/gpu/drm/radeon/radeon_atombios.c')
| -rw-r--r-- | drivers/gpu/drm/radeon/radeon_atombios.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c index 112c96352562..ad913542ec1a 100644 --- a/drivers/gpu/drm/radeon/radeon_atombios.c +++ b/drivers/gpu/drm/radeon/radeon_atombios.c @@ -711,13 +711,16 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev) (ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT *) (ctx->bios + data_offset + le16_to_cpu(router_obj->asObjects[k].usSrcDstTableOffset)); + u8 *num_dst_objs = (u8 *) + ((u8 *)router_src_dst_table + 1 + + (router_src_dst_table->ucNumberOfSrc * 2)); + u16 *dst_objs = (u16 *)(num_dst_objs + 1); int enum_id; router.router_id = router_obj_id; - for (enum_id = 0; enum_id < router_src_dst_table->ucNumberOfDst; - enum_id++) { + for (enum_id = 0; enum_id < (*num_dst_objs); enum_id++) { if (le16_to_cpu(path->usConnObjectId) == - le16_to_cpu(router_src_dst_table->usDstObjectID[enum_id])) + le16_to_cpu(dst_objs[enum_id])) break; } |