On Fri, Jun 21, 2013 at 8:25 AM, Dan Carpenter dan.carpenter@oracle.com wrote:

Hello Alex Deucher,

The patch eed45b30cd14: "drm/radeon/kms: get HPD info for connectors" from Dec 4, 2009, leads to the following warning: "drivers/gpu/drm/radeon/radeon_atombios.c:950 radeon_get_atom_connector_info_from_supported_devices_table() error: buffer overflow 'supported_devices->info.asConnInfo' 10 <= 15"

drivers/gpu/drm/radeon/radeon_atombios.c 943 if (frev > 1) 944 max_device = ATOM_MAX_SUPPORTED_DEVICE; 945 else 946 max_device = ATOM_MAX_SUPPORTED_DEVICE_INFO; 947 948 for (i = 0; i < max_device; i++) { 949 ATOM_CONNECTOR_INFO_I2C ci = 950 supported_devices->info.asConnInfo[i];

If max_device is set to ATOM_MAX_SUPPORTED_DEVICE then we read beyond the end of the asConnInfo[] array and crash.

The array is variably sized based on the vbios version so the array size in the header is largely meaningless.

Alex

951 952 bios_connectors[i].valid = false; 953

regards, dan carpenter