Commit 79964dba authored by Maciej Purski's avatar Maciej Purski Committed by Andrzej Hajda

drm/bridge/sii8620: Fix memory corruption

Function sii8620_mt_read_devcap_reg_recv() used to read array index
from a wrong msg register, which caused writing out of array
bounds. It led to writing on other fields of struct sii8620.
Signed-off-by: default avatarMaciej Purski <m.purski@samsung.com>
Fixes: e9c6da27 ("drm/bridge/sii8620: add reading device capability
       registers")
Signed-off-by: default avatarAndrzej Hajda <a.hajda@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1503311571-25819-1-git-send-email-m.purski@samsung.com
parent fe4600a5
...@@ -597,9 +597,9 @@ static void sii8620_mt_read_devcap(struct sii8620 *ctx, bool xdevcap) ...@@ -597,9 +597,9 @@ static void sii8620_mt_read_devcap(struct sii8620 *ctx, bool xdevcap)
static void sii8620_mt_read_devcap_reg_recv(struct sii8620 *ctx, static void sii8620_mt_read_devcap_reg_recv(struct sii8620 *ctx,
struct sii8620_mt_msg *msg) struct sii8620_mt_msg *msg)
{ {
u8 reg = msg->reg[0] & 0x7f; u8 reg = msg->reg[1] & 0x7f;
if (msg->reg[0] & 0x80) if (msg->reg[1] & 0x80)
ctx->xdevcap[reg] = msg->ret; ctx->xdevcap[reg] = msg->ret;
else else
ctx->devcap[reg] = msg->ret; ctx->devcap[reg] = msg->ret;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment