diff options
| author | Nicolai Hähnle <Nicolai.Haehnle@amd.com> | 2016-06-14 12:10:07 +0200 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2016-07-07 14:51:32 -0400 |
| commit | 8db6f83bef165bc47d1f1cd56afdec37b47917d1 (patch) | |
| tree | dbf58a3a206f26b40c6a3e4cf141d55b4b50bd21 /drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | |
| parent | 840dd4c60526e90b298e1ee019ffcdd25a90b780 (diff) | |
| download | linux-8db6f83bef165bc47d1f1cd56afdec37b47917d1.tar.bz2 | |
drm/amdgpu: remove cgs_acpi_method_argument member method_length
It was redundant with data_length, and in fact set incorrectly in one case
leading to an out-of-bound read by memcpy in acpi_ut_copy_esimple_to_isimple,
reported by CONFIG_KASAN=y.
Signed-off-by: Nicolai Hähnle <Nicolai.Haehnle@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 7 |
1 files changed, 2 insertions, 5 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c index 1f9fd07d5d16..9ffdd090d9ec 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c @@ -973,11 +973,11 @@ static int amdgpu_cgs_acpi_eval_object(struct cgs_device *cgs_device, params->integer.value = argument->value; break; case ACPI_TYPE_STRING: - params->string.length = argument->method_length; + params->string.length = argument->data_length; params->string.pointer = argument->pointer; break; case ACPI_TYPE_BUFFER: - params->buffer.length = argument->method_length; + params->buffer.length = argument->data_length; params->buffer.pointer = argument->pointer; break; default: @@ -1080,17 +1080,14 @@ int amdgpu_cgs_call_acpi_method(struct cgs_device *cgs_device, struct cgs_acpi_method_info info = {0}; acpi_input[0].type = CGS_ACPI_TYPE_INTEGER; - acpi_input[0].method_length = sizeof(uint32_t); acpi_input[0].data_length = sizeof(uint32_t); acpi_input[0].value = acpi_function; acpi_input[1].type = CGS_ACPI_TYPE_BUFFER; - acpi_input[1].method_length = CGS_ACPI_MAX_BUFFER_SIZE; acpi_input[1].data_length = input_size; acpi_input[1].pointer = pinput; acpi_output.type = CGS_ACPI_TYPE_BUFFER; - acpi_output.method_length = CGS_ACPI_MAX_BUFFER_SIZE; acpi_output.data_length = output_size; acpi_output.pointer = poutput; |