video: ipu: fix out of bounds access

We need to access reg stp_rep9, but not stp_rep[(9 - 1) / 2].
If using "__raw_writel(0, DI_STP_REP(disp, 9))", this will exceeds
the size of stp_rep array.

Signed-off-by: Peng Fan <[email protected]>
Acked-by: Liu Ying <[email protected]>
Cc: Stefano Babic <[email protected]>
Cc: Anatolij Gustschin <[email protected]>

diff --git a/drivers/video/ipu_disp.c b/drivers/video/ipu_disp.c
index 4faeafb6351d4d3e75376e704b479ebad4a3c6b3..e08ddd4a4e9fa78472fb0bd3b95e217ee155788f 100644 (file)
--- a/drivers/video/ipu_disp.c
+++ b/drivers/video/ipu_disp.c
@@ -1119,7 +1119,7 @@ int32_t ipu_init_sync_panel(int disp, uint32_t pixel_clk,
                reg &= 0x0000FFFF;
                __raw_writel(reg, DI_STP_REP(disp, 6));
                __raw_writel(0, DI_STP_REP(disp, 7));
-               __raw_writel(0, DI_STP_REP(disp, 9));
+               __raw_writel(0, DI_STP_REP9(disp));
 
                /* Init template microcode */
                if (disp) {

diff --git a/drivers/video/ipu_regs.h b/drivers/video/ipu_regs.h
index c2c134a7de0738beca41c7b871c0869d5f6fe031..0d3fe069e910fab46b01725309c98c2e9ae5853e 100644 (file)
--- a/drivers/video/ipu_regs.h
+++ b/drivers/video/ipu_regs.h
@@ -338,6 +338,7 @@ struct ipu_dmfc {
 #define DI_SW_GEN0(di, gen)    (&DI_REG(di)->sw_gen0[gen - 1])
 #define DI_SW_GEN1(di, gen)    (&DI_REG(di)->sw_gen1[gen - 1])
 #define DI_STP_REP(di, gen)    (&DI_REG(di)->stp_rep[(gen - 1) / 2])
+#define DI_STP_REP9(di)                (&DI_REG(di)->stp_rep9)
 #define DI_SYNC_AS_GEN(di)     (&DI_REG(di)->sync_as)
 #define DI_DW_GEN(di, gen)     (&DI_REG(di)->dw_gen[gen])
 #define DI_DW_SET(di, gen, set)        (&DI_REG(di)->dw_set[gen + 12 * set])