From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: [patch] drm/nouveau: off by one in nouveau_drm_vblank_enable() Date: Wed, 3 Apr 2013 11:05:38 +0300 Message-ID: <20130403080538.GA11225@longonot.mountain> References: <5159DF8D.2010506@canonical.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by gabe.freedesktop.org (Postfix) with ESMTP id 9A71EE5CEC for ; Wed, 3 Apr 2013 01:07:41 -0700 (PDT) Content-Disposition: inline In-Reply-To: <5159DF8D.2010506@canonical.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org Errors-To: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org To: David Airlie Cc: Dave Airlie , Ben Skeggs , dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org The test here should be ">= ARRAY_SIZE()" instead of "> ARRAY_SIZE()". Signed-off-by: Dan Carpenter --- This was introduced in git://git.freedesktop.org/git/nouveau/linux-2.6 drm-nouveau-fixes-3.9 It hadn't hit linux-next yet yesterday. diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c index c95decf..e11f8e4 100644 --- a/drivers/gpu/drm/nouveau/nouveau_drm.c +++ b/drivers/gpu/drm/nouveau/nouveau_drm.c @@ -86,7 +86,7 @@ nouveau_drm_vblank_enable(struct drm_device *dev, int head) struct nouveau_drm *drm = nouveau_drm(dev); struct nouveau_disp *pdisp = nouveau_disp(drm->device); - if (WARN_ON_ONCE(head > ARRAY_SIZE(drm->vblank))) + if (WARN_ON_ONCE(head >= ARRAY_SIZE(drm->vblank))) return -EIO; WARN_ON_ONCE(drm->vblank[head].func); drm->vblank[head].func = nouveau_drm_vblank_handler;