From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Thu, 11 Jun 2015 15:13:04 +0000 Subject: [patch] drm/amdgpu: off by one check in dce_v8_0_hpd_irq() Message-Id: <20150611151304.GD12192@mwanda> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: David Airlie Cc: Chunming Zhou , Marek =?utf-8?B?T2zFocOhaw==?= , kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, yanyang1 , Alex Deucher , Christian =?iso-8859-1?Q?K=F6nig?= It should be >= instead of > or we go beyond the end of the interrupt_status_offsets[] array. Also I changed it to use ARRAY_SIZE(). Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c index 9e8b9f1..0f70dc9 100644 --- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c +++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c @@ -3397,7 +3397,7 @@ static int dce_v8_0_hpd_irq(struct amdgpu_device *adev, uint32_t disp_int, mask, int_control, tmp; unsigned hpd; - if (entry->src_data > 6) { + if (entry->src_data >= ARRAY_SIZE(interrupt_status_offsets)) { DRM_DEBUG("Unhandled interrupt: %d %d\n", entry->src_id, entry->src_data); return 0; } From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: [patch] drm/amdgpu: off by one check in dce_v8_0_hpd_irq() Date: Thu, 11 Jun 2015 18:13:04 +0300 Message-ID: <20150611151304.GD12192@mwanda> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by gabe.freedesktop.org (Postfix) with ESMTP id 2BE716E4EB for ; Thu, 11 Jun 2015 08:13:22 -0700 (PDT) Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: David Airlie Cc: Chunming Zhou , Marek =?utf-8?B?T2zFocOhaw==?= , kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, yanyang1 , Alex Deucher , Christian =?iso-8859-1?Q?K=F6nig?= List-Id: dri-devel@lists.freedesktop.org SXQgc2hvdWxkIGJlID49IGluc3RlYWQgb2YgPiBvciB3ZSBnbyBiZXlvbmQgdGhlIGVuZCBvZiB0 aGUKaW50ZXJydXB0X3N0YXR1c19vZmZzZXRzW10gYXJyYXkuICBBbHNvIEkgY2hhbmdlZCBpdCB0 byB1c2UKQVJSQVlfU0laRSgpLgoKU2lnbmVkLW9mZi1ieTogRGFuIENhcnBlbnRlciA8ZGFuLmNh cnBlbnRlckBvcmFjbGUuY29tPgoKZGlmZiAtLWdpdCBhL2RyaXZlcnMvZ3B1L2RybS9hbWQvYW1k Z3B1L2RjZV92OF8wLmMgYi9kcml2ZXJzL2dwdS9kcm0vYW1kL2FtZGdwdS9kY2VfdjhfMC5jCmlu ZGV4IDllOGI5ZjEuLjBmNzBkYzkgMTAwNjQ0Ci0tLSBhL2RyaXZlcnMvZ3B1L2RybS9hbWQvYW1k Z3B1L2RjZV92OF8wLmMKKysrIGIvZHJpdmVycy9ncHUvZHJtL2FtZC9hbWRncHUvZGNlX3Y4XzAu YwpAQCAtMzM5Nyw3ICszMzk3LDcgQEAgc3RhdGljIGludCBkY2VfdjhfMF9ocGRfaXJxKHN0cnVj dCBhbWRncHVfZGV2aWNlICphZGV2LAogCXVpbnQzMl90IGRpc3BfaW50LCBtYXNrLCBpbnRfY29u dHJvbCwgdG1wOwogCXVuc2lnbmVkIGhwZDsKIAotCWlmIChlbnRyeS0+c3JjX2RhdGEgPiA2KSB7 CisJaWYgKGVudHJ5LT5zcmNfZGF0YSA+PSBBUlJBWV9TSVpFKGludGVycnVwdF9zdGF0dXNfb2Zm c2V0cykpIHsKIAkJRFJNX0RFQlVHKCJVbmhhbmRsZWQgaW50ZXJydXB0OiAlZCAlZFxuIiwgZW50 cnktPnNyY19pZCwgZW50cnktPnNyY19kYXRhKTsKIAkJcmV0dXJuIDA7CiAJfQpfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpkcmktZGV2ZWwgbWFpbGluZyBs aXN0CmRyaS1kZXZlbEBsaXN0cy5mcmVlZGVza3RvcC5vcmcKaHR0cDovL2xpc3RzLmZyZWVkZXNr dG9wLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2RyaS1kZXZlbAo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754252AbbFKPNX (ORCPT ); Thu, 11 Jun 2015 11:13:23 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:25344 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751489AbbFKPNW (ORCPT ); Thu, 11 Jun 2015 11:13:22 -0400 Date: Thu, 11 Jun 2015 18:13:04 +0300 From: Dan Carpenter To: David Airlie Cc: Alex Deucher , Jammy Zhou , Christian =?iso-8859-1?Q?K=F6nig?= , yanyang1 , Chunming Zhou , Marek =?utf-8?B?T2zFocOhaw==?= , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] drm/amdgpu: off by one check in dce_v8_0_hpd_irq() Message-ID: <20150611151304.GD12192@mwanda> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org It should be >= instead of > or we go beyond the end of the interrupt_status_offsets[] array. Also I changed it to use ARRAY_SIZE(). Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c index 9e8b9f1..0f70dc9 100644 --- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c +++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c @@ -3397,7 +3397,7 @@ static int dce_v8_0_hpd_irq(struct amdgpu_device *adev, uint32_t disp_int, mask, int_control, tmp; unsigned hpd; - if (entry->src_data > 6) { + if (entry->src_data >= ARRAY_SIZE(interrupt_status_offsets)) { DRM_DEBUG("Unhandled interrupt: %d %d\n", entry->src_id, entry->src_data); return 0; }