svn commit: r278152 - head/sys/dev/drm2/i915

[Konstantin Belousov]

Author: kib
Date: Tue Feb  3 13:43:03 2015
New Revision: 278152
URL: https://svnweb.freebsd.org/changeset/base/278152

Log:
  Do not access gmbus_ports array past its end.
  
  Reported and tested by:	hselasky
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/sys/dev/drm2/i915/intel_iic.c

Modified: head/sys/dev/drm2/i915/intel_iic.c
==============================================================================
--- head/sys/dev/drm2/i915/intel_iic.c	Tue Feb  3 12:09:48 2015	(r278151)
+++ head/sys/dev/drm2/i915/intel_iic.c	Tue Feb  3 13:43:03 2015	(r278152)
@@ -556,7 +556,9 @@ intel_gmbus_attach(device_t idev)
 	pin = device_get_unit(idev);
 	port = pin + 1;
 
-	snprintf(sc->name, sizeof(sc->name), "gmbus %s", gmbus_ports[pin].name);
+	snprintf(sc->name, sizeof(sc->name), "gmbus %s",
+	    intel_gmbus_is_port_valid(port) ? gmbus_ports[pin].name :
+	    "reserved");
 	device_set_desc(idev, sc->name);
 
 	/* By default use a conservative clock rate */
@@ -613,17 +615,21 @@ intel_iicbb_attach(device_t idev)
 {
 	struct intel_iic_softc *sc;
 	struct drm_i915_private *dev_priv;
-	int pin;
+	int pin, port;
 
 	sc = device_get_softc(idev);
 	sc->drm_dev = device_get_softc(device_get_parent(idev));
 	dev_priv = sc->drm_dev->dev_private;
 	pin = device_get_unit(idev);
+	port = pin + 1;
 
 	snprintf(sc->name, sizeof(sc->name), "i915 iicbb %s",
-	    gmbus_ports[pin].name);
+	    intel_gmbus_is_port_valid(port) ? gmbus_ports[pin].name :
+	    "reserved");
 	device_set_desc(idev, sc->name);
 
+	if (!intel_gmbus_is_port_valid(port))
+		pin = 1 ; /* GPIOA, VGA */
 	sc->reg0 = pin | GMBUS_RATE_100KHZ;
 	sc->reg = dev_priv->gpio_mmio_base + gmbus_ports[pin].reg;