drm/radeon/kms/atom: fix gpio i2c table overrun

Commit Message

Alex Deucher April 1, 2010, 4:57 p.m. UTC

None

Patch

diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c
b/drivers/gpu/drm/radeon/radeon_atombios.c
index b969eda..bb37da4 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -69,16 +69,19 @@  static inline struct radeon_i2c_bus_rec
radeon_lookup_i2c_gpio(struct radeon_dev
 	struct radeon_i2c_bus_rec i2c;
 	int index = GetIndexIntoMasterTable(DATA, GPIO_I2C_Info);
 	struct _ATOM_GPIO_I2C_INFO *i2c_info;
-	uint16_t data_offset;
-	int i;
+	uint16_t data_offset, size;
+	int i, num_indices;

 	memset(&i2c, 0, sizeof(struct radeon_i2c_bus_rec));
 	i2c.valid = false;

-	if (atom_parse_data_header(ctx, index, NULL, NULL, NULL, &data_offset)) {
+	if (atom_parse_data_header(ctx, index, &size, NULL, NULL, &data_offset)) {
 		i2c_info = (struct _ATOM_GPIO_I2C_INFO *)(ctx->bios + data_offset);

-		for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) {
+		num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
+			sizeof(ATOM_GPIO_I2C_INFO);
+
+		for (i = 0; i < num_indices; i++) {
 			gpio = &i2c_info->asGPIO_Info[i];