* [PATH] i915: Read outside array bounds
@ 2009-07-25 22:50 Roel Kluin
2009-07-28 21:50 ` Andrew Morton
0 siblings, 1 reply; 4+ messages in thread
From: Roel Kluin @ 2009-07-25 22:50 UTC (permalink / raw)
To: airlied, pavel, dri-devel, linux-pm, Andrew Morton
dev_priv->saveSWF1 is a 16 element array, but this reads up to index 22
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
save_state does not do this addition, can it be removed? please review.
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 9e1d16e..1d04e19 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -598,7 +598,7 @@ int i915_restore_state(struct drm_device *dev)
for (i = 0; i < 16; i++) {
I915_WRITE(SWF00 + (i << 2), dev_priv->saveSWF0[i]);
- I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i+7]);
+ I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i]);
}
for (i = 0; i < 3; i++)
I915_WRITE(SWF30 + (i << 2), dev_priv->saveSWF2[i]);
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATH] i915: Read outside array bounds
2009-07-25 22:50 [PATH] i915: Read outside array bounds Roel Kluin
@ 2009-07-28 21:50 ` Andrew Morton
2009-07-29 21:06 ` Rafael J. Wysocki
[not found] ` <200907292306.15195.rjw@sisk.pl>
0 siblings, 2 replies; 4+ messages in thread
From: Andrew Morton @ 2009-07-28 21:50 UTC (permalink / raw)
To: Roel Kluin; +Cc: airlied, linux-pm, dri-devel, Jesse Barnes
(cc jbarnes)
On Sun, 26 Jul 2009 00:50:38 +0200
Roel Kluin <roel.kluin@gmail.com> wrote:
> dev_priv->saveSWF1 is a 16 element array, but this reads up to index 22
>
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
> ---
> save_state does not do this addition, can it be removed? please review.
>
> diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
> index 9e1d16e..1d04e19 100644
> --- a/drivers/gpu/drm/i915/i915_suspend.c
> +++ b/drivers/gpu/drm/i915/i915_suspend.c
> @@ -598,7 +598,7 @@ int i915_restore_state(struct drm_device *dev)
>
> for (i = 0; i < 16; i++) {
> I915_WRITE(SWF00 + (i << 2), dev_priv->saveSWF0[i]);
> - I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i+7]);
> + I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i]);
> }
> for (i = 0; i < 3; i++)
> I915_WRITE(SWF30 + (i << 2), dev_priv->saveSWF2[i]);
This looks rather correct and the original code looked rather wrong.
Someone please tell me that this might fix one of our splendid number
of i915 bugs :(
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATH] i915: Read outside array bounds
2009-07-28 21:50 ` Andrew Morton
@ 2009-07-29 21:06 ` Rafael J. Wysocki
[not found] ` <200907292306.15195.rjw@sisk.pl>
1 sibling, 0 replies; 4+ messages in thread
From: Rafael J. Wysocki @ 2009-07-29 21:06 UTC (permalink / raw)
To: Jesse Barnes; +Cc: airlied, linux-pm, dri-devel, Roel Kluin, Andrew Morton
On Tuesday 28 July 2009, Andrew Morton wrote:
> (cc jbarnes)
>
> On Sun, 26 Jul 2009 00:50:38 +0200
> Roel Kluin <roel.kluin@gmail.com> wrote:
>
> > dev_priv->saveSWF1 is a 16 element array, but this reads up to index 22
> >
> > Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
> > ---
> > save_state does not do this addition, can it be removed? please review.
> >
> > diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
> > index 9e1d16e..1d04e19 100644
> > --- a/drivers/gpu/drm/i915/i915_suspend.c
> > +++ b/drivers/gpu/drm/i915/i915_suspend.c
> > @@ -598,7 +598,7 @@ int i915_restore_state(struct drm_device *dev)
> >
> > for (i = 0; i < 16; i++) {
> > I915_WRITE(SWF00 + (i << 2), dev_priv->saveSWF0[i]);
> > - I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i+7]);
> > + I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i]);
> > }
> > for (i = 0; i < 3; i++)
> > I915_WRITE(SWF30 + (i << 2), dev_priv->saveSWF2[i]);
>
> This looks rather correct and the original code looked rather wrong.
>
> Someone please tell me that this might fix one of our splendid number
> of i915 bugs :(
Hmm, Jesse, what's your opinion about this one? It looks correct to me.
Rafael
^ permalink raw reply [flat|nested] 4+ messages in thread[parent not found: <200907292306.15195.rjw@sisk.pl>]
* Re: [PATH] i915: Read outside array bounds
[not found] ` <200907292306.15195.rjw@sisk.pl>
@ 2009-08-02 23:45 ` Jesse Barnes
0 siblings, 0 replies; 4+ messages in thread
From: Jesse Barnes @ 2009-08-02 23:45 UTC (permalink / raw)
To: Rafael J. Wysocki; +Cc: airlied, linux-pm, dri-devel, Roel Kluin, Andrew Morton
On Wed, 29 Jul 2009 23:06:14 +0200
"Rafael J. Wysocki" <rjw@sisk.pl> wrote:
> On Tuesday 28 July 2009, Andrew Morton wrote:
> > (cc jbarnes)
> >
> > On Sun, 26 Jul 2009 00:50:38 +0200
> > Roel Kluin <roel.kluin@gmail.com> wrote:
> >
> > > dev_priv->saveSWF1 is a 16 element array, but this reads up to
> > > index 22
> > >
> > > Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
> > > ---
> > > save_state does not do this addition, can it be removed? please
> > > review.
> > >
> > > diff --git a/drivers/gpu/drm/i915/i915_suspend.c
> > > b/drivers/gpu/drm/i915/i915_suspend.c index 9e1d16e..1d04e19
> > > 100644 --- a/drivers/gpu/drm/i915/i915_suspend.c
> > > +++ b/drivers/gpu/drm/i915/i915_suspend.c
> > > @@ -598,7 +598,7 @@ int i915_restore_state(struct drm_device *dev)
> > >
> > > for (i = 0; i < 16; i++) {
> > > I915_WRITE(SWF00 + (i << 2),
> > > dev_priv->saveSWF0[i]);
> > > - I915_WRITE(SWF10 + (i << 2),
> > > dev_priv->saveSWF1[i+7]);
> > > + I915_WRITE(SWF10 + (i << 2),
> > > dev_priv->saveSWF1[i]); }
> > > for (i = 0; i < 3; i++)
> > > I915_WRITE(SWF30 + (i << 2),
> > > dev_priv->saveSWF2[i]);
> >
> > This looks rather correct and the original code looked rather wrong.
> >
> > Someone please tell me that this might fix one of our splendid
> > number of i915 bugs :(
>
> Hmm, Jesse, what's your opinion about this one? It looks correct to
> me.
Yeah, the fix looks fine. And yes, we're upstreaming bug fixes as
quickly as we responsibly can.
Jesse
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2009-08-02 23:45 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-07-25 22:50 [PATH] i915: Read outside array bounds Roel Kluin
2009-07-28 21:50 ` Andrew Morton
2009-07-29 21:06 ` Rafael J. Wysocki
[not found] ` <200907292306.15195.rjw@sisk.pl>
2009-08-02 23:45 ` Jesse Barnes
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox