diff options
| author | Liu Ying <victor.liu@nxp.com> | 2017-10-12 14:55:45 +0800 |
|---|---|---|
| committer | Leonard Crestez <leonard.crestez@nxp.com> | 2018-08-24 12:41:33 +0300 |
| commit | ff1f26a8c656b1eb48c671ac78536ed5a9d8d5f8 (patch) | |
| tree | 30cebfcca2461e18ecd71c65b4c288895f04f1f7 /drivers/gpu/imx/dpu | |
| parent | 33143c970d797b6161a0297762b6e22075bedad9 (diff) | |
MLK-16575 gpu: imx: dpu: fetcheco: Correct dpu->fe_priv[] access in dpu_fe_init()
The array size of dpu->fe_priv is only 4. We need to access the correct
entry of the array by comparing the id passed in dpu_fe_init() with
the entries in the fe_ids array instead of using the id directly.
This may avoid out-of-boundary array access on dpu->fe_priv.
Fixes: 936b978c44f3 ("MLK-16075-11 gpu: imx: dpu: Add basic fetcheco units support")
Signed-off-by: Liu Ying <victor.liu@nxp.com>
Diffstat (limited to 'drivers/gpu/imx/dpu')
| -rw-r--r-- | drivers/gpu/imx/dpu/dpu-fetcheco.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/gpu/imx/dpu/dpu-fetcheco.c b/drivers/gpu/imx/dpu/dpu-fetcheco.c index 7fa85ae73ae6..c3ac6fd7cdf2 100644 --- a/drivers/gpu/imx/dpu/dpu-fetcheco.c +++ b/drivers/gpu/imx/dpu/dpu-fetcheco.c @@ -482,12 +482,17 @@ int dpu_fe_init(struct dpu_soc *dpu, unsigned int id, unsigned long pec_base, unsigned long base) { struct dpu_fetcheco *fe; + int i; fe = devm_kzalloc(dpu->dev, sizeof(*fe), GFP_KERNEL); if (!fe) return -ENOMEM; - dpu->fe_priv[id] = fe; + for (i = 0; i < ARRAY_SIZE(fe_ids); i++) + if (fe_ids[i] == id) + break; + + dpu->fe_priv[i] = fe; fe->pec_base = devm_ioremap(dpu->dev, pec_base, SZ_16); if (!fe->pec_base) |