7217 Buffer overflow in i915 driver
Reviewed by: Dan McDonald <danmcd@omniti.com>
Reviewed by: Richard Lowe <richlowe@richlowe.net>
Reviewed by: Garrett D'Amore <garrett@damore.org>
Reviewed by: Toomas Soome <tsoome@me.com>

@@ -38,10 +38,14 @@
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
 /*
+ * Copyright 2014 RackTop Systems.
+ */
+
+/*
  * I915 DRM Driver for Solaris
  *
  * This driver provides the hardware 3D acceleration support for Intel
  * integrated video devices (e.g. i8xx/i915/i945 series chipsets), under the
  * DRI (Direct Rendering Infrastructure). DRM (Direct Rendering Manager) here

@@ -706,11 +710,11 @@
         /* Memory arbitration state */
         S3_WRITE (MI_ARB_STATE, s3_priv->saveMI_ARB_STATE | 0xffff0000);
         
         for (i = 0; i < 16; i++) {
                 S3_WRITE(SWF0 + (i << 2), s3_priv->saveSWF0[i]);
-                S3_WRITE(SWF10 + (i << 2), s3_priv->saveSWF1[i+7]);
+                S3_WRITE(SWF10 + (i << 2), s3_priv->saveSWF1[i]);
         }
         for (i = 0; i < 3; i++)
                 S3_WRITE(SWF30 + (i << 2), s3_priv->saveSWF2[i]);
 
         S3_WRITE(I915REG_PGTBL_CTRL, s3_priv->pgtbl_ctl);