From owner-svn-src-all@FreeBSD.ORG Tue Feb 3 13:43:04 2015 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 134A71FE; Tue, 3 Feb 2015 13:43:04 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id F3C98DCD; Tue, 3 Feb 2015 13:43:03 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t13Dh3LW059896; Tue, 3 Feb 2015 13:43:03 GMT (envelope-from kib@FreeBSD.org) Received: (from kib@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t13Dh3wW059895; Tue, 3 Feb 2015 13:43:03 GMT (envelope-from kib@FreeBSD.org) Message-Id: <201502031343.t13Dh3wW059895@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: kib set sender to kib@FreeBSD.org using -f From: Konstantin Belousov Date: Tue, 3 Feb 2015 13:43:03 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r278152 - head/sys/dev/drm2/i915 X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Feb 2015 13:43:04 -0000 Author: kib Date: Tue Feb 3 13:43:03 2015 New Revision: 278152 URL: https://svnweb.freebsd.org/changeset/base/278152 Log: Do not access gmbus_ports array past its end. Reported and tested by: hselasky Sponsored by: The FreeBSD Foundation Modified: head/sys/dev/drm2/i915/intel_iic.c Modified: head/sys/dev/drm2/i915/intel_iic.c ============================================================================== --- head/sys/dev/drm2/i915/intel_iic.c Tue Feb 3 12:09:48 2015 (r278151) +++ head/sys/dev/drm2/i915/intel_iic.c Tue Feb 3 13:43:03 2015 (r278152) @@ -556,7 +556,9 @@ intel_gmbus_attach(device_t idev) pin = device_get_unit(idev); port = pin + 1; - snprintf(sc->name, sizeof(sc->name), "gmbus %s", gmbus_ports[pin].name); + snprintf(sc->name, sizeof(sc->name), "gmbus %s", + intel_gmbus_is_port_valid(port) ? gmbus_ports[pin].name : + "reserved"); device_set_desc(idev, sc->name); /* By default use a conservative clock rate */ @@ -613,17 +615,21 @@ intel_iicbb_attach(device_t idev) { struct intel_iic_softc *sc; struct drm_i915_private *dev_priv; - int pin; + int pin, port; sc = device_get_softc(idev); sc->drm_dev = device_get_softc(device_get_parent(idev)); dev_priv = sc->drm_dev->dev_private; pin = device_get_unit(idev); + port = pin + 1; snprintf(sc->name, sizeof(sc->name), "i915 iicbb %s", - gmbus_ports[pin].name); + intel_gmbus_is_port_valid(port) ? gmbus_ports[pin].name : + "reserved"); device_set_desc(idev, sc->name); + if (!intel_gmbus_is_port_valid(port)) + pin = 1 ; /* GPIOA, VGA */ sc->reg0 = pin | GMBUS_RATE_100KHZ; sc->reg = dev_priv->gpio_mmio_base + gmbus_ports[pin].reg;