https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=230032
--- Comment #4 from FStl <[email protected]> --- I have found two bugs (so far) in the code of the intel driver. In /sys/dev/drm2/i915/intel_sdvo.c, in function intel_sdvo_write_cmd: Line 458: msgs = malloc(args_len + 3 * sizeof(*msgs), DRM_MEM_KMS, M_NOWAIT | M_ZERO); This line is allocating "args_len" bytes plus "3 * sizeof(*msgs)" bytes of memory, which is not as intended and actually leads to memory corruption. The correct code should be: msgs = malloc((args_len + 3) * sizeof(*msgs), DRM_MEM_KMS, M_NOWAIT | M_ZERO); Lines 493-503: ret = -iicbus_transfer(intel_sdvo->i2c, msgs, i+3); if (ret < 0) { DRM_DEBUG_KMS("I2c transfer returned %d\n", ret); ret = false; goto out; } out: free(msgs, DRM_MEM_KMS); free(buf, DRM_MEM_KMS); return ret; The function iicbus_transfer returns 0 on success, and in that case, ret = -0 = 0 = false and so the function intel_sdvo_write_cmd ends up returning false even when it has actually succeeded. The correct code should be: ret = iicbus_transfer(intel_sdvo->i2c, msgs, i+3); if (ret != 0) { DRM_DEBUG_KMS("I2c transfer returned %d\n", ret); ret = false; } else ret = true; free(msgs, DRM_MEM_KMS); free(buf, DRM_MEM_KMS); return ret; Correcting these two bugs makes the intel_sdvo_get_capabilities call successful, but the intel_sdvo_set_target_input call is still unsuccessful (this call is successful on FreeBSD 10). So there are still some bugs left... -- You are receiving this mail because: You are the assignee for the bug. _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-bugs To unsubscribe, send any mail to "[email protected]"
