kern/46196: array overflow in sys/external/bsd/drm/dist/shared-core/i915_suspend.c

[Manuel.Bouyer%lip6.fr@localhost]

>Number:         46196
>Category:       kern
>Synopsis:       array overflow in 
>sys/external/bsd/drm/dist/shared-core/i915_suspend.c
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Mar 14 21:00:00 +0000 2012
>Originator:     Manuel.Bouyer%lip6.fr@localhost
>Release:        NetBSD 6.0_BETA
>Organization:
>Environment:
System: NetBSD pop.soc.lip6.fr 6.0_BETA NetBSD 6.0_BETA (XEN3PAE_DOMU) i386
Architecture: i386
Machine: i386
>Description:
        building an amd64 GENERIC kernel with -03, I got:
/dsk/l1/misc/bouyer/quota2/src/sys/external/bsd/drm/dist/shared-core/i915_suspend.c:
 In function 'i915_restore_state':
/dsk/l1/misc/bouyer/quota2/src/sys/external/bsd/drm/dist/shared-core/i915_suspend.c:515:3:
 error: array subscript is above array bounds

        indeed we have:
        for (i = 0; i < 16; i++) {
                I915_WRITE(SWF00 + (i << 2), dev_priv->saveSWF0[i]);
                I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i+7]);
        }

        but saveSWF1[] has only 16 elements. So there's obviously something
        wrong, but I don't know what ...

>How-To-Repeat:
        builds amd64 GENERIC with -O3
>Fix: