drm/i915/dsi: be defensive about out of bounds operation byte
Untie the VBT based generic panel driver from the VBT parsing, so that the two don't have to be updated in lockstep. Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Link: http://patchwork.freedesktop.org/patch/msgid/01c71ac89a9db8bc7b8ae0fb05c50a5fae362dc4.1450702954.git.jani.nikula@intel.com
This commit is contained in:
parent
5cda0d20f9
commit
28c72840a7
|
@ -232,11 +232,9 @@ static const u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, const u8 *data)
|
|||
typedef const u8 * (*fn_mipi_elem_exec)(struct intel_dsi *intel_dsi,
|
||||
const u8 *data);
|
||||
static const fn_mipi_elem_exec exec_elem[] = {
|
||||
NULL, /* reserved */
|
||||
mipi_exec_send_packet,
|
||||
mipi_exec_delay,
|
||||
mipi_exec_gpio,
|
||||
NULL, /* status read; later */
|
||||
[MIPI_SEQ_ELEM_SEND_PKT] = mipi_exec_send_packet,
|
||||
[MIPI_SEQ_ELEM_DELAY] = mipi_exec_delay,
|
||||
[MIPI_SEQ_ELEM_GPIO] = mipi_exec_gpio,
|
||||
};
|
||||
|
||||
/*
|
||||
|
@ -264,7 +262,6 @@ static const char *sequence_name(enum mipi_seq seq_id)
|
|||
static void generic_exec_sequence(struct intel_dsi *intel_dsi, const u8 *data)
|
||||
{
|
||||
fn_mipi_elem_exec mipi_elem_exec;
|
||||
int index;
|
||||
|
||||
if (!data)
|
||||
return;
|
||||
|
@ -277,15 +274,14 @@ static void generic_exec_sequence(struct intel_dsi *intel_dsi, const u8 *data)
|
|||
|
||||
/* parse each byte till we reach end of sequence byte - 0x00 */
|
||||
while (1) {
|
||||
index = *data;
|
||||
mipi_elem_exec = exec_elem[index];
|
||||
if (!mipi_elem_exec) {
|
||||
DRM_ERROR("Unsupported MIPI element, skipping sequence execution\n");
|
||||
u8 operation_byte = *data++;
|
||||
if (operation_byte >= ARRAY_SIZE(exec_elem) ||
|
||||
!exec_elem[operation_byte]) {
|
||||
DRM_ERROR("Unsupported MIPI operation byte %u\n",
|
||||
operation_byte);
|
||||
return;
|
||||
}
|
||||
|
||||
/* goto element payload */
|
||||
data++;
|
||||
mipi_elem_exec = exec_elem[operation_byte];
|
||||
|
||||
/* execute the element specific rotines */
|
||||
data = mipi_elem_exec(intel_dsi, data);
|
||||
|
|
Loading…
Reference in a new issue