[Bug 230032] Intel graphics driver fails to detect DVI output

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=230032

--- Comment #4 from FStl <felixstella at protonmail.com> ---
I have found two bugs (so far) in the code of the intel driver.

In /sys/dev/drm2/i915/intel_sdvo.c, in function intel_sdvo_write_cmd:


Line 458:
        msgs = malloc(args_len + 3 * sizeof(*msgs), DRM_MEM_KMS, M_NOWAIT |
M_ZERO);

This line is allocating "args_len" bytes plus "3 * sizeof(*msgs)" bytes of
memory, which is not as intended and actually leads to memory corruption. The
correct code should be:

        msgs = malloc((args_len + 3) * sizeof(*msgs), DRM_MEM_KMS, M_NOWAIT |
M_ZERO);


Lines 493-503:
        ret = -iicbus_transfer(intel_sdvo->i2c, msgs, i+3);
        if (ret < 0) {
                DRM_DEBUG_KMS("I2c transfer returned %d\n", ret);
                ret = false;
                goto out;
        }

out:
        free(msgs, DRM_MEM_KMS);
        free(buf, DRM_MEM_KMS);
        return ret;

The function iicbus_transfer returns 0 on success, and in that case, ret = -0 =
0 = false and so the function intel_sdvo_write_cmd ends up returning false even
when it has actually succeeded. The correct code should be:

        ret = iicbus_transfer(intel_sdvo->i2c, msgs, i+3);
        if (ret != 0) {
                DRM_DEBUG_KMS("I2c transfer returned %d\n", ret);
                ret = false;
        }
        else
                ret = true;

        free(msgs, DRM_MEM_KMS);
        free(buf, DRM_MEM_KMS);
        return ret;


Correcting these two bugs makes the intel_sdvo_get_capabilities call
successful, but the intel_sdvo_set_target_input call is still unsuccessful
(this call is successful on FreeBSD 10). So there are still some bugs left...

-- 
You are receiving this mail because:
You are the assignee for the bug.