mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 17:59:32 +00:00
drm/i915/bios: Fix the sequence size calculations for MIPI seq v3
Two errors in a single line. The size was read from the wrong offset,
and the end index didn't take the five bytes for sequence byte and size
of sequence into account. Fix it all, and break up the calculations a
bit to make it clearer.
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reported-and-tested-by: Mika Kahola <mika.kahola@intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Fixes: 2a33d93486
("drm/i915/bios: add support for MIPI sequence block v3")
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1452784327-27258-1-git-send-email-jani.nikula@intel.com
This commit is contained in:
parent
965fd602a6
commit
6765bd6dd2
1 changed files with 14 additions and 3 deletions
|
@ -842,6 +842,7 @@ static int goto_next_sequence_v3(const u8 *data, int index, int total)
|
|||
{
|
||||
int seq_end;
|
||||
u16 len;
|
||||
u32 size_of_sequence;
|
||||
|
||||
/*
|
||||
* Could skip sequence based on Size of Sequence alone, but also do some
|
||||
|
@ -852,14 +853,24 @@ static int goto_next_sequence_v3(const u8 *data, int index, int total)
|
|||
return 0;
|
||||
}
|
||||
|
||||
seq_end = index + *((const u32 *)(data + 1));
|
||||
/* Skip Sequence Byte. */
|
||||
index++;
|
||||
|
||||
/*
|
||||
* Size of Sequence. Excludes the Sequence Byte and the size itself,
|
||||
* includes MIPI_SEQ_ELEM_END byte, excludes the final MIPI_SEQ_END
|
||||
* byte.
|
||||
*/
|
||||
size_of_sequence = *((const uint32_t *)(data + index));
|
||||
index += 4;
|
||||
|
||||
seq_end = index + size_of_sequence;
|
||||
if (seq_end > total) {
|
||||
DRM_ERROR("Invalid sequence size\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Skip Sequence Byte and Size of Sequence. */
|
||||
for (index = index + 5; index < total; index += len) {
|
||||
for (; index < total; index += len) {
|
||||
u8 operation_byte = *(data + index);
|
||||
index++;
|
||||
|
||||
|
|
Loading…
Reference in a new issue