Eric Lee / smarc-uboot

Download as
Browse Code ยป

Commit badb1ea09d046703c3002f64e7578aa6fdeec8e2

Authored by Peng Fan
Committed by guoyin.chen
1 parent 07ef17d0e1
Exists in smarc-imx_v2015.04_4.1.15_1.0.0_ga and in 1 other branch imx_v2015.04_4.1.15_1.0.0_ga

MLK-11897 video: ipu: fix out of bounds access 

We need to access reg stp_rep9, but not stp_rep[(9 - 1) / 2].
If using "__raw_writel(0, DI_STP_REP(disp, 9))", this will exceeds
the size of stp_rep array.

Acked-by: Liu Ying <Ying.Liu@freescale.com>
Signed-off-by: Peng Fan <Peng.Fan@freescale.com>

Showing 2 changed files with 3 additions and 2 deletions Side-by-side Diff

drivers/video/ipu_disp.c
Diff comments   View file @ badb1ea
... ... @@ -1129,7 +1129,7 @@
1129 1129 reg &= 0x0000FFFF;
1130 1130 __raw_writel(reg, DI_STP_REP(disp, 6));
1131 1131 __raw_writel(0, DI_STP_REP(disp, 7));
1132   - __raw_writel(0, DI_STP_REP(disp, 9));
  1132 + __raw_writel(0, DI_STP_REP9(disp));
1133 1133  
1134 1134 /* Init template microcode */
1135 1135 if (disp) {
drivers/video/ipu_regs.h
Diff comments   View file @ badb1ea
... ... @@ -6,7 +6,7 @@
6 6 *
7 7 * Linux IPU driver for MX51:
8 8 *
9   - * (C) Copyright 2005-2014 Freescale Semiconductor, Inc.
  9 + * (C) Copyright 2005-2015 Freescale Semiconductor, Inc.
10 10 *
11 11 * SPDX-License-Identifier: GPL-2.0+
12 12 */
... ... @@ -338,6 +338,7 @@
338 338 #define DI_SW_GEN0(di, gen) (&DI_REG(di)->sw_gen0[gen - 1])
339 339 #define DI_SW_GEN1(di, gen) (&DI_REG(di)->sw_gen1[gen - 1])
340 340 #define DI_STP_REP(di, gen) (&DI_REG(di)->stp_rep[(gen - 1) / 2])
  341 +#define DI_STP_REP9(di) (&DI_REG(di)->stp_rep9)
341 342 #define DI_SYNC_AS_GEN(di) (&DI_REG(di)->sync_as)
342 343 #define DI_DW_GEN(di, gen) (&DI_REG(di)->dw_gen[gen])
343 344 #define DI_DW_SET(di, gen, set) (&DI_REG(di)->dw_set[gen + 12 * set])