Re: [linux-pm] [PATH] i915: Read outside array bounds

[Andrew M. <ak...@li...>]

(cc jbarnes)

On Sun, 26 Jul 2009 00:50:38 +0200
Roel Kluin <roe...@gm...> wrote:

> dev_priv->saveSWF1 is a 16 element array, but this reads up to index 22
> 
> Signed-off-by: Roel Kluin <roe...@gm...>
> ---
> save_state does not do this addition, can it be removed? please review.
> 
> diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
> index 9e1d16e..1d04e19 100644
> --- a/drivers/gpu/drm/i915/i915_suspend.c
> +++ b/drivers/gpu/drm/i915/i915_suspend.c
> @@ -598,7 +598,7 @@ int i915_restore_state(struct drm_device *dev)
>  
>  	for (i = 0; i < 16; i++) {
>  		I915_WRITE(SWF00 + (i << 2), dev_priv->saveSWF0[i]);
> -		I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i+7]);
> +		I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i]);
>  	}
>  	for (i = 0; i < 3; i++)
>  		I915_WRITE(SWF30 + (i << 2), dev_priv->saveSWF2[i]);

This looks rather correct and the original code looked rather wrong.

Someone please tell me that this might fix one of our splendid number
of i915 bugs :(