From 668259c84d73cdd485cbe60c60d6844e99703f7e Mon Sep 17 00:00:00 2001 From: Konstantin Belousov Date: Tue, 3 Feb 2015 13:43:03 +0000 Subject: [PATCH] Do not access gmbus_ports array past its end. Reported and tested by: hselasky Sponsored by: The FreeBSD Foundation --- sys/dev/drm2/i915/intel_iic.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/sys/dev/drm2/i915/intel_iic.c b/sys/dev/drm2/i915/intel_iic.c index fdd59e5d1ed..aa12a784f03 100644 --- a/sys/dev/drm2/i915/intel_iic.c +++ b/sys/dev/drm2/i915/intel_iic.c @@ -556,7 +556,9 @@ intel_gmbus_attach(device_t idev) pin = device_get_unit(idev); port = pin + 1; - snprintf(sc->name, sizeof(sc->name), "gmbus %s", gmbus_ports[pin].name); + snprintf(sc->name, sizeof(sc->name), "gmbus %s", + intel_gmbus_is_port_valid(port) ? gmbus_ports[pin].name : + "reserved"); device_set_desc(idev, sc->name); /* By default use a conservative clock rate */ @@ -613,17 +615,21 @@ intel_iicbb_attach(device_t idev) { struct intel_iic_softc *sc; struct drm_i915_private *dev_priv; - int pin; + int pin, port; sc = device_get_softc(idev); sc->drm_dev = device_get_softc(device_get_parent(idev)); dev_priv = sc->drm_dev->dev_private; pin = device_get_unit(idev); + port = pin + 1; snprintf(sc->name, sizeof(sc->name), "i915 iicbb %s", - gmbus_ports[pin].name); + intel_gmbus_is_port_valid(port) ? gmbus_ports[pin].name : + "reserved"); device_set_desc(idev, sc->name); + if (!intel_gmbus_is_port_valid(port)) + pin = 1 ; /* GPIOA, VGA */ sc->reg0 = pin | GMBUS_RATE_100KHZ; sc->reg = dev_priv->gpio_mmio_base + gmbus_ports[pin].reg;