On Fri, Jun 21, 2013 at 8:25 AM, Dan Carpenter <dan.carpenter at oracle.com> wrote:
> Hello Alex Deucher,
>
> The patch eed45b30cd14: "drm/radeon/kms: get HPD info for connectors"
> from Dec 4, 2009, leads to the following warning:
> "drivers/gpu/drm/radeon/radeon_atombios.c:950
> radeon_get_atom_connector_info_from_supported_devices_table()
> error: buffer overflow 'supported_devices->info.asConnInfo' 10 <= 15"
>
> drivers/gpu/drm/radeon/radeon_atombios.c
> 943 if (frev > 1)
> 944 max_device = ATOM_MAX_SUPPORTED_DEVICE;
> 945 else
> 946 max_device = ATOM_MAX_SUPPORTED_DEVICE_INFO;
> 947
> 948 for (i = 0; i < max_device; i++) {
> 949 ATOM_CONNECTOR_INFO_I2C ci =
> 950 supported_devices->info.asConnInfo[i];
>
> If max_device is set to ATOM_MAX_SUPPORTED_DEVICE then we read beyond
> the end of the asConnInfo[] array and crash.
The array is variably sized based on the vbios version so the array
size in the header is largely meaningless.
Alex
>
> 951
> 952 bios_connectors[i].valid = false;
> 953
>
> regards,
> dan carpenter
>