Skip to contentSkip to conversation

video: ipu: fix out of bounds access

PATCH New Peng Fan 2 participants 2 messages Nov 27, 2015 – Nov 30, 2015 Framebuffer layer

lore
Share & tools
lore

Peng Fan

author
#0 lore raw

PATCH 1/1 video: ipu: fix out of bounds access

We need to access reg stp_rep9, but not stp_rep[(9 - 1) / 2]. If using "__raw_writel(0, DI_STP_REP(disp, 9))", this will exceeds the size of stp_rep array.

Signed-off-by Peng Fan <[email protected]>
Acked-by Liu Ying <[email protected]>
Cc Stefano Babic <[email protected]>
Cc Anatolij Gustschin <[email protected]>
---
 drivers/video/ipu_disp.c | 2 +-
 drivers/video/ipu_regs.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/video/ipu_disp.c +1 -1
index 7a87478..cbac9f7 100644
@@ -1117,7 +1117,7 @@ int32_t ipu_init_sync_panel(int disp, uint32_t pixel_clk,
 		reg &= 0x0000FFFF;
 		__raw_writel(reg, DI_STP_REP(disp, 6));
 		__raw_writel(0, DI_STP_REP(disp, 7));
-		__raw_writel(0, DI_STP_REP(disp, 9));
+		__raw_writel(0, DI_STP_REP9(disp));
 
 		/* Init template microcode */
 		if (disp) {
drivers/video/ipu_regs.h +1 -0
index c2c134a..0d3fe06 100644
@@ -338,6 +338,7 @@ struct ipu_dmfc {
 #define DI_SW_GEN0(di, gen)	(&DI_REG(di)->sw_gen0[gen - 1])
 #define DI_SW_GEN1(di, gen)	(&DI_REG(di)->sw_gen1[gen - 1])
 #define DI_STP_REP(di, gen)	(&DI_REG(di)->stp_rep[(gen - 1) / 2])
+#define DI_STP_REP9(di)		(&DI_REG(di)->stp_rep9)
 #define DI_SYNC_AS_GEN(di)	(&DI_REG(di)->sync_as)
 #define DI_DW_GEN(di, gen)	(&DI_REG(di)->dw_gen[gen])
 #define DI_DW_SET(di, gen, set)	(&DI_REG(di)->dw_set[gen + 12 * set])
Signature · 1 line
2.6.2
#1 lore raw

PATCH 1/1 video: ipu: fix out of bounds access

Hello,

Quoted 4 lines · On Fri, 27 Nov 2015 10:00:10 +0800 Peng Fan <[email protected]> wrote:

We need to access reg stp_rep9, but not stp_rep[(9 - 1) / 2]. If using "__raw_writel(0, DI_STP_REP(disp, 9))", this will exceeds the size of stp_rep array.

Quoted 8 lines
Signed-off-by Peng Fan <[email protected]>
Acked-by Liu Ying <[email protected]>
Cc Stefano Babic <[email protected]>
Cc Anatolij Gustschin <[email protected]>
---
 drivers/video/ipu_disp.c | 2 +-
 drivers/video/ipu_regs.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

applied to u-boot-video/master. Thanks!

Anatolij