From mboxrd@z Thu Jan  1 00:00:00 1970
From: Alan Cox <alan@lxorguk.ukuu.org.uk>
Subject: Unchecked memory allocations in Intel driver
Date: Mon, 4 Jul 2011 13:27:51 +0100
Message-ID: <20110704132751.4eaf5489@lxorguk.ukuu.org.uk>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org>
Received: from www.etchedpixels.co.uk (earthlight.etchedpixels.co.uk
	[81.2.110.250])
	by gabe.freedesktop.org (Postfix) with ESMTP id 0AFC09EB06
	for <dri-devel@lists.freedesktop.org>;
	Mon,  4 Jul 2011 05:25:18 -0700 (PDT)
List-Unsubscribe: <http://lists.freedesktop.org/mailman/options/dri-devel>,
	<mailto:dri-devel-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <http://lists.freedesktop.org/archives/dri-devel>
List-Post: <mailto:dri-devel@lists.freedesktop.org>
List-Help: <mailto:dri-devel-request@lists.freedesktop.org?subject=help>
List-Subscribe: <http://lists.freedesktop.org/mailman/listinfo/dri-devel>,
	<mailto:dri-devel-request@lists.freedesktop.org?subject=subscribe>
Sender: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org
Errors-To: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org
To: dri-devel@lists.freedesktop.org, keithp@keithp.com
List-Id: dri-devel@lists.freedesktop.org

Found this going over intel_bios.c and cross comparing it with the
Intel/IMG driver intel_bios.c

        temp_mode = kzalloc(sizeof(*temp_mode), GFP_KERNEL);
        temp_downclock = panel_fixed_mode->clock;
        /*
         * enumerate the LVDS panel timing info entry in VBT to check
        whether
         * the LVDS downclock is found.
         */
        for (i = 0; i < 16; i++) {
                entry = (struct bdb_lvds_lfp_data_entry *)
                        ((uint8_t *)lvds_lfp_data->data + (lfp_data_size
        * i)); dvo_timing = (struct lvds_dvo_timing *)
                        ((unsigned char *)entry + dvo_timing_offset);
 
                fill_detail_timing_data(temp_mode, dvo_timing);


The one for IMG devices (GMA500 etc) has an additional unchecked kmalloc
which the i915 driver has fixed.