Commit 55a4c5c5 authored Apr 22, 2010 by Dan Carpenter Committed by Dave Airlie Jun 08, 2010

nouveau: off by one in nv50_gpio_location()



If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the
end of the array.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

parent 6d696305

drivers/gpu/drm/nouveau/nv50_gpio.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry gpio, uint32_t reg, uint32_t *shift)
		{
		const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };

		if (gpio->line > 32)
		if (gpio->line >= 32)
		return -EINVAL;

		*reg = nv50_gpio_reg[gpio->line >> 3];