Commit bd119f47 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-intel-fixes-2021-04-09' of... 

Merge tag 'drm-intel-fixes-2021-04-09' of git://anongit.freedesktop.org/drm/drm-intel

 into drm-fixes

- Fix invalid access to ACPI _DSM objects (Takashi)

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/YHAW6NInrybUoat6@intel.com
parents d416bd0b b6a37a93

drivers/gpu/drm/i915/display/intel_acpi.c

+20 −2
Original line number Diff line number Diff line
@@ -84,13 +84,31 @@ static void intel_dsm_platform_mux_info(acpi_handle dhandle) 
		return;

	}



	if (!pkg->package.count) {

		DRM_DEBUG_DRIVER("no connection in _DSM\n");

		return;

	}



	connector_count = &pkg->package.elements[0];

	DRM_DEBUG_DRIVER("MUX info connectors: %lld\n",

		  (unsigned long long)connector_count->integer.value);

	for (i = 1; i < pkg->package.count; i++) {

		union acpi_object *obj = &pkg->package.elements[i];

		union acpi_object *connector_id = &obj->package.elements[0];

		union acpi_object *info = &obj->package.elements[1];

		union acpi_object *connector_id;

		union acpi_object *info;



		if (obj->type != ACPI_TYPE_PACKAGE || obj->package.count < 2) {

			DRM_DEBUG_DRIVER("Invalid object for MUX #%d\n", i);

			continue;

		}



		connector_id = &obj->package.elements[0];

		info = &obj->package.elements[1];

		if (info->type != ACPI_TYPE_BUFFER || info->buffer.length < 4) {

			DRM_DEBUG_DRIVER("Invalid info for MUX obj #%d\n", i);

			continue;

		}



		DRM_DEBUG_DRIVER("Connector id: 0x%016llx\n",

			  (unsigned long long)connector_id->integer.value);

		DRM_DEBUG_DRIVER("  port id: %s\n",