Skip to contentSkip to conversation

drm/radeon: fix a couple of array index errors

PATCH In review Darren Jenkins 3 participants 3 messages Dec 30, 2009 – Jan 7, 2010

Subsystems (3)
DRM drivers Kernel janitors Radeon and amdgpu DRM drivers
lore
Share & tools
lore

Darren Jenkins

author
#0 lore raw

PATCH 1/1 drm/radeon: fix a couple of array index errors

There are a couple of array overruns, and some associated confusion in the code.
This is just a wild guess at what the code should actually look like.

Coverity CID: 13305 13306

Signed-off-by Darren Jenkins <[email protected]>
gpu/drm/radeon/radeon_legacy_tv.c +5 -3
index 3a12bb0..c37535a 100644
@@ -112,6 +112,8 @@ static const uint16_t vert_timing_NTSC[] = {
 	0x1817,
 	0x21d4,
 	0x0002,
+	0x0000,
+	0x0000,
 	0
 };
 

@@ -623,9 +625,9 @@ void radeon_legacy_tv_mode_set(struct drm_encoder *encoder,
 	}
 	flicker_removal = (tmp + 500) / 1000;
 
-	if (flicker_removal < 3)
-		flicker_removal = 3;
-	for (i = 0; i < 6; ++i) {
+	if (flicker_removal < 2)
+		flicker_removal = 2;
+	for (i = 0; i < ARRAY_SIZE(SLOPE_limit); ++i) {
 		if (flicker_removal = SLOPE_limit[i])
 			break;
 	}
gpu/drm/radeon/radeon_mode.h +2 -2
index 402369d..abee9a9 100644
@@ -218,8 +218,8 @@ struct radeon_mode_info {
 
 };
 
-#define MAX_H_CODE_TIMING_LEN 32
-#define MAX_V_CODE_TIMING_LEN 32
+#define MAX_H_CODE_TIMING_LEN 16
+#define MAX_V_CODE_TIMING_LEN 16
 
 /* need to store these as reading
    back code tables is excessive */
maintainer
#1 lore raw
Quoted 3 lines · Darren Jenkins

There are a couple of array overruns, and some associated confusion in the code.
This is just a wild guess at what the code should actually look like.

Alex can you take a look at this, though I suspect its mostly stuff that is wrong in the GATOS
code in userspace as well.

Might need to fix it there as well, the ARRAY_SIZE change is sane, the flicker removal
is plausible, the array sizings also totally wierd.

Dave.

Quoted 49 lines

Coverity CID: 13305 13306

Signed-off-by Darren Jenkins <[email protected]>
gpu/drm/radeon/radeon_legacy_tv.c +2 -0
index 3a12bb0..c37535a 100644
@@ -112,6 +112,8 @@ static const uint16_t vert_timing_NTSC[] = {
        0x1817,
        0x21d4,
        0x0002,
+       0x0000,
+       0x0000,

       0
 };

gpu/drm/radeon/radeon_legacy_tv.c +3 -3
@@ -623,9 +625,9 @@ void radeon_legacy_tv_mode_set(struct drm_encoder *encoder,
        }
        flicker_removal = (tmp + 500) / 1000;
 
-       if (flicker_removal < 3)
-               flicker_removal = 3;
-       for (i = 0; i < 6; ++i) {
+       if (flicker_removal < 2)
+               flicker_removal = 2;
+       for (i = 0; i < ARRAY_SIZE(SLOPE_limit); ++i) {
                if (flicker_removal == SLOPE_limit[i])
                        break;
        }
gpu/drm/radeon/radeon_mode.h +2 -2
index 402369d..abee9a9 100644
@@ -218,8 +218,8 @@ struct radeon_mode_info {
 
  };
 
-#define MAX_H_CODE_TIMING_LEN 32
-#define MAX_V_CODE_TIMING_LEN 32
+#define MAX_H_CODE_TIMING_LEN 16
+#define MAX_V_CODE_TIMING_LEN 16
 
  /* need to store these as reading

   back code tables is excessive */

Quoted 6 lines

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

------------------------------------------------------------------------------
This SF.Net email is sponsored by the Verizon Developer Community Take advantage of Verizon's best-in-class app development support A streamlined, 14 day to market process makes app distribution fast and easy Join now and get one step closer to millions of Verizon customers
http://p.sf.net/sfu/verizon-dev2dev
--

#2 lore raw
Quoted 6 lines · Dave Airlie
Quoted 3 lines · Darren Jenkins

There are a couple of array overruns, and some associated confusion in the code.
This is just a wild guess at what the code should actually look like.

Quoted 8 lines

Alex can you take a look at this, though I suspect its mostly stuff that is wrong in the GATOS
code in userspace as well.

Might need to fix it there as well, the ARRAY_SIZE change is sane, the flicker removal
is plausible, the array sizings also totally wierd.

I think the attached patch was the original intent of the h/v size code. The ARRAY_SIZE and flicker removal changes look fine.

Alex

Quoted 50 lines

Dave.

Quoted 49 lines

Coverity CID: 13305 13306

Signed-off-by Darren Jenkins <[email protected]>
gpu/drm/radeon/radeon_legacy_tv.c +2 -0
index 3a12bb0..c37535a 100644
@@ -112,6 +112,8 @@ static const uint16_t vert_timing_NTSC[] = {
        0x1817,
        0x21d4,
        0x0002,
+       0x0000,
+       0x0000,

       0
 };

gpu/drm/radeon/radeon_legacy_tv.c +3 -3
@@ -623,9 +625,9 @@ void radeon_legacy_tv_mode_set(struct drm_encoder *encoder,
        }
        flicker_removal = (tmp + 500) / 1000;
 
-       if (flicker_removal < 3)
-               flicker_removal = 3;
-       for (i = 0; i < 6; ++i) {
+       if (flicker_removal < 2)
+               flicker_removal = 2;
+       for (i = 0; i < ARRAY_SIZE(SLOPE_limit); ++i) {
                if (flicker_removal == SLOPE_limit[i])
                        break;
        }
gpu/drm/radeon/radeon_mode.h +2 -2
index 402369d..abee9a9 100644
@@ -218,8 +218,8 @@ struct radeon_mode_info {
 
  };
 
-#define MAX_H_CODE_TIMING_LEN 32
-#define MAX_V_CODE_TIMING_LEN 32
+#define MAX_H_CODE_TIMING_LEN 16
+#define MAX_V_CODE_TIMING_LEN 16
 
  /* need to store these as reading

   back code tables is excessive */

Quoted 7 lines
Quoted 6 lines

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

From d266c2ff727c56430aedfcbce1141adef51c93b3 Mon Sep 17 00:00:00 2001
From: Darren Jenkins <[email protected]>
Date: Thu, 7 Jan 2010 01:35:21 -0500
Subject: [PATCH] drm/radeon: fix a couple of array index errors

There are a couple of array overruns, and some associated confusion in the code.
This is just a wild guess at what the code should actually look like.

Coverity CID: 13305 13306

agd5f: fix up the original intent of the timing code

Signed-off-by Darren Jenkins <[email protected]>
Signed-off-by Alex Deucher <[email protected]>
---
 drivers/gpu/drm/radeon/radeon_legacy_tv.c |   14 +++++++-------
 1 files changed, 7 insertions(+), 7 deletions(-)
drivers/gpu/drm/radeon/radeon_legacy_tv.c +7 -7
index 3a12bb0..417684d 100644
@@ -77,7 +77,7 @@ struct radeon_tv_mode_constants {
 	unsigned pix_to_tv;
 };
 
-static const uint16_t hor_timing_NTSC[] = {
+static const uint16_t hor_timing_NTSC[MAX_H_CODE_TIMING_LEN] = {
 	0x0007,
 	0x003f,
 	0x0263,

@@ -98,7 +98,7 @@ static const uint16_t hor_timing_NTSC[] = {
 	0
 };
 
-static const uint16_t vert_timing_NTSC[] = {
+static const uint16_t vert_timing_NTSC[MAX_V_CODE_TIMING_LEN] = {
 	0x2001,
 	0x200d,
 	0x1006,

@@ -115,7 +115,7 @@ static const uint16_t vert_timing_NTSC[] = {
 	0
 };
 
-static const uint16_t hor_timing_PAL[] = {
+static const uint16_t hor_timing_PAL[MAX_H_CODE_TIMING_LEN] = {
 	0x0007,
 	0x0058,
 	0x027c,

@@ -136,7 +136,7 @@ static const uint16_t hor_timing_PAL[] = {
 	0
 };
 
-static const uint16_t vert_timing_PAL[] = 	{
+static const uint16_t vert_timing_PAL[MAX_V_CODE_TIMING_LEN] = {
 	0x2001,
 	0x200c,
 	0x1005,

@@ -623,9 +623,9 @@ void radeon_legacy_tv_mode_set(struct drm_encoder *encoder,
 	}
 	flicker_removal = (tmp + 500) / 1000;
 
-	if (flicker_removal < 3)
-		flicker_removal = 3;
-	for (i = 0; i < 6; ++i) {
+	if (flicker_removal < 2)
+		flicker_removal = 2;
+	for (i = 0; i < ARRAY_SIZE(SLOPE_limit); ++i) {
 		if (flicker_removal == SLOPE_limit[i])
 			break;
 	}
Signature · 1 line
1.5.6.3

------------------------------------------------------------------------------
This SF.Net email is sponsored by the Verizon Developer Community Take advantage of Verizon's best-in-class app development support A streamlined, 14 day to market process makes app distribution fast and easy Join now and get one step closer to millions of Verizon customers
http://p.sf.net/sfu/verizon-dev2dev

--
_______________________________________________
Dri-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/dri-devel