Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5fd9c581 authored by Dan Carpenter's avatar Dan Carpenter Committed by Alex Deucher
Browse files

drm/radeon/dpm: off by one in si_set_mc_special_registers() 



These checks should be ">=" instead of ">".  j is used as an offset into
the table->mc_reg_address[] array and that has
SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE (16) elements.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
parent 96d8df84

drivers/gpu/drm/radeon/si_dpm.c

+3 −3
Original line number Diff line number Diff line
@@ -5208,7 +5208,7 @@ static int si_set_mc_special_registers(struct radeon_device *rdev, 
					table->mc_reg_table_entry[k].mc_data[j] |= 0x100;

			}

			j++;

			if (j > SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)

			if (j >= SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)

				return -EINVAL;



			if (!pi->mem_gddr5) {
@@ -5218,7 +5218,7 @@ static int si_set_mc_special_registers(struct radeon_device *rdev, 
					table->mc_reg_table_entry[k].mc_data[j] =

						(table->mc_reg_table_entry[k].mc_data[i] & 0xffff0000) >> 16;

				j++;

				if (j > SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)

				if (j >= SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)

					return -EINVAL;

			}

			break;
@@ -5231,7 +5231,7 @@ static int si_set_mc_special_registers(struct radeon_device *rdev, 
					(temp_reg & 0xffff0000) |

					(table->mc_reg_table_entry[k].mc_data[i] & 0x0000ffff);

			j++;

			if (j > SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)

			if (j >= SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)

				return -EINVAL;

			break;

		default: