Skip site navigation (1)Skip section navigation (2) 
Date:      Fri, 27 Jul 2018 12:39:48 +0000
From:      bugzilla-noreply@freebsd.org
To:        bugs@FreeBSD.org
Subject:   [Bug 230032] Intel graphics driver fails to detect DVI output
Message-ID:  <bug-230032-227-QMPkEGzWcT@https.bugs.freebsd.org/bugzilla/>
In-Reply-To: <bug-230032-227@https.bugs.freebsd.org/bugzilla/>
References:  <bug-230032-227@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D230032

--- Comment #4 from FStl <felixstella@protonmail.com> ---
I have found two bugs (so far) in the code of the intel driver.

In /sys/dev/drm2/i915/intel_sdvo.c, in function intel_sdvo_write_cmd:


Line 458:
        msgs =3D malloc(args_len + 3 * sizeof(*msgs), DRM_MEM_KMS, M_NOWAIT=
 |
M_ZERO);

This line is allocating "args_len" bytes plus "3 * sizeof(*msgs)" bytes of
memory, which is not as intended and actually leads to memory corruption. T=
he
correct code should be:

        msgs =3D malloc((args_len + 3) * sizeof(*msgs), DRM_MEM_KMS, M_NOWA=
IT |
M_ZERO);


Lines 493-503:
        ret =3D -iicbus_transfer(intel_sdvo->i2c, msgs, i+3);
        if (ret < 0) {
                DRM_DEBUG_KMS("I2c transfer returned %d\n", ret);
                ret =3D false;
                goto out;
        }

out:
        free(msgs, DRM_MEM_KMS);
        free(buf, DRM_MEM_KMS);
        return ret;

The function iicbus_transfer returns 0 on success, and in that case, ret =
=3D -0 =3D
0 =3D false and so the function intel_sdvo_write_cmd ends up returning fals=
e even
when it has actually succeeded. The correct code should be:

        ret =3D iicbus_transfer(intel_sdvo->i2c, msgs, i+3);
        if (ret !=3D 0) {
                DRM_DEBUG_KMS("I2c transfer returned %d\n", ret);
                ret =3D false;
        }
        else
                ret =3D true;

        free(msgs, DRM_MEM_KMS);
        free(buf, DRM_MEM_KMS);
        return ret;


Correcting these two bugs makes the intel_sdvo_get_capabilities call
successful, but the intel_sdvo_set_target_input call is still unsuccessful
(this call is successful on FreeBSD 10). So there are still some bugs left.=
..

--=20
You are receiving this mail because:
You are the assignee for the bug.=

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-230032-227-QMPkEGzWcT>