Commit fb93df1c authored by Alex Deucher's avatar Alex Deucher

drm/radeon: fix handling of variable sized arrays for router objects

The table has the following format:

typedef struct _ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT         //usSrcDstTableOffset pointing to this structure
{
  UCHAR               ucNumberOfSrc;
  USHORT              usSrcObjectID[1];
  UCHAR               ucNumberOfDst;
  USHORT              usDstObjectID[1];
}ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT;

usSrcObjectID[] and usDstObjectID[] are variably sized, so we
can't access them directly.  Use pointers and update the offset
appropriately when accessing the Dst members.
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
parent acf88deb
...@@ -711,13 +711,16 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev) ...@@ -711,13 +711,16 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
(ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT *) (ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT *)
(ctx->bios + data_offset + (ctx->bios + data_offset +
le16_to_cpu(router_obj->asObjects[k].usSrcDstTableOffset)); le16_to_cpu(router_obj->asObjects[k].usSrcDstTableOffset));
u8 *num_dst_objs = (u8 *)
((u8 *)router_src_dst_table + 1 +
(router_src_dst_table->ucNumberOfSrc * 2));
u16 *dst_objs = (u16 *)(num_dst_objs + 1);
int enum_id; int enum_id;
router.router_id = router_obj_id; router.router_id = router_obj_id;
for (enum_id = 0; enum_id < router_src_dst_table->ucNumberOfDst; for (enum_id = 0; enum_id < (*num_dst_objs); enum_id++) {
enum_id++) {
if (le16_to_cpu(path->usConnObjectId) == if (le16_to_cpu(path->usConnObjectId) ==
le16_to_cpu(router_src_dst_table->usDstObjectID[enum_id])) le16_to_cpu(dst_objs[enum_id]))
break; break;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment