fbdev: fix cea_modes array size

CEA defines 64 modes, indexed from 1 to 64. modedb has cea_modes arrays,
which contains 64 entries. However, the code uses the CEA indices
directly, i.e. the first mode is at cea_modes[1]. This means the array
is one too short.

This does not cause references to uninitialized memory as the code in
fbmon only allows indexes up to 63, and the cea_modes does not contain
an entry for the mode 64 so it could not be used in any case.

However, the code contains a check 'if (idx > ARRAY_SIZE(cea_modes)',
and while that check is a no-op as at that point idx cannot be >= 63, it
upsets static checkers.

Fix this by increasing the cea_array size to be 65, and change the code
to allow mode 64.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index d787533d9c8b0b0e589fe4eaa217b29debbb6845..47c3191ec313dbc617c015df22832f6e0ee522cb 100644 (file)
--- a/drivers/video/fbdev/core/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -1072,9 +1072,9 @@ void fb_edid_add_monspecs(unsigned char *edid, struct fb_monspecs *specs)
 
        for (i = specs->modedb_len + num; i < specs->modedb_len + num + svd_n; i++) {
                int idx = svd[i - specs->modedb_len - num];
-               if (!idx || idx > 63) {
+               if (!idx || idx >= ARRAY_SIZE(cea_modes)) {
                        pr_warning("Reserved SVD code %d\n", idx);
-               } else if (idx > ARRAY_SIZE(cea_modes) || !cea_modes[idx].xres) {
+               } else if (!cea_modes[idx].xres) {
                        pr_warning("Unimplemented SVD code %d\n", idx);
                } else {
                        memcpy(&m[i], cea_modes + idx, sizeof(m[i]));

diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c
index 7d07cf824b64c0839a2a1b1c92f99744a7e2f86a..2510fa728d77160326781219ec554ae50c99be4a 100644 (file)
--- a/drivers/video/fbdev/core/modedb.c
+++ b/drivers/video/fbdev/core/modedb.c
@@ -289,7 +289,7 @@ static const struct fb_videomode modedb[] = {
 };
 
 #ifdef CONFIG_FB_MODE_HELPERS
-const struct fb_videomode cea_modes[64] = {
+const struct fb_videomode cea_modes[65] = {
        /* #1: 640x480p@59.94/60Hz */
        [1] = {
                NULL, 60, 640, 480, 39722, 48, 16, 33, 10, 96, 2, 0,

diff --git a/include/linux/fb.h b/include/linux/fb.h
index 043f3283b71c42cd72ecc99a9006eb9b862f5f75..bc9afa74ee11cb3f7c2876280aad4da50ad6df7b 100644 (file)
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -788,7 +788,7 @@ struct dmt_videomode {
 
 extern const char *fb_mode_option;
 extern const struct fb_videomode vesa_modes[];
-extern const struct fb_videomode cea_modes[64];
+extern const struct fb_videomode cea_modes[65];
 extern const struct dmt_videomode dmt_modes[];
 
 struct fb_modelist {