Commit 28c72840 authored by Jani Nikula's avatar Jani Nikula

drm/i915/dsi: be defensive about out of bounds operation byte

Untie the VBT based generic panel driver from the VBT parsing, so that
the two don't have to be updated in lockstep.
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/01c71ac89a9db8bc7b8ae0fb05c50a5fae362dc4.1450702954.git.jani.nikula@intel.com
parent 5cda0d20
...@@ -232,11 +232,9 @@ static const u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, const u8 *data) ...@@ -232,11 +232,9 @@ static const u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, const u8 *data)
typedef const u8 * (*fn_mipi_elem_exec)(struct intel_dsi *intel_dsi, typedef const u8 * (*fn_mipi_elem_exec)(struct intel_dsi *intel_dsi,
const u8 *data); const u8 *data);
static const fn_mipi_elem_exec exec_elem[] = { static const fn_mipi_elem_exec exec_elem[] = {
NULL, /* reserved */ [MIPI_SEQ_ELEM_SEND_PKT] = mipi_exec_send_packet,
mipi_exec_send_packet, [MIPI_SEQ_ELEM_DELAY] = mipi_exec_delay,
mipi_exec_delay, [MIPI_SEQ_ELEM_GPIO] = mipi_exec_gpio,
mipi_exec_gpio,
NULL, /* status read; later */
}; };
/* /*
...@@ -264,7 +262,6 @@ static const char *sequence_name(enum mipi_seq seq_id) ...@@ -264,7 +262,6 @@ static const char *sequence_name(enum mipi_seq seq_id)
static void generic_exec_sequence(struct intel_dsi *intel_dsi, const u8 *data) static void generic_exec_sequence(struct intel_dsi *intel_dsi, const u8 *data)
{ {
fn_mipi_elem_exec mipi_elem_exec; fn_mipi_elem_exec mipi_elem_exec;
int index;
if (!data) if (!data)
return; return;
...@@ -277,15 +274,14 @@ static void generic_exec_sequence(struct intel_dsi *intel_dsi, const u8 *data) ...@@ -277,15 +274,14 @@ static void generic_exec_sequence(struct intel_dsi *intel_dsi, const u8 *data)
/* parse each byte till we reach end of sequence byte - 0x00 */ /* parse each byte till we reach end of sequence byte - 0x00 */
while (1) { while (1) {
index = *data; u8 operation_byte = *data++;
mipi_elem_exec = exec_elem[index]; if (operation_byte >= ARRAY_SIZE(exec_elem) ||
if (!mipi_elem_exec) { !exec_elem[operation_byte]) {
DRM_ERROR("Unsupported MIPI element, skipping sequence execution\n"); DRM_ERROR("Unsupported MIPI operation byte %u\n",
operation_byte);
return; return;
} }
mipi_elem_exec = exec_elem[operation_byte];
/* goto element payload */
data++;
/* execute the element specific rotines */ /* execute the element specific rotines */
data = mipi_elem_exec(intel_dsi, data); data = mipi_elem_exec(intel_dsi, data);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment