* [patch] nouveau: off by one in nv50_gpio_location()
@ 2010-04-22 9:40 Dan Carpenter
2010-06-03 1:23 ` Ben Skeggs
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2010-04-22 9:40 UTC (permalink / raw)
To: David Airlie; +Cc: dri-devel, kernel-janitors, Ben Skeggs
If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the
end of the array.
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/gpu/drm/nouveau/nv50_gpio.c b/drivers/gpu/drm/nouveau/nv50_gpio.c
index c61782b..bb47ad7 100644
--- a/drivers/gpu/drm/nouveau/nv50_gpio.c
+++ b/drivers/gpu/drm/nouveau/nv50_gpio.c
@@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift)
{
const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
- if (gpio->line > 32)
+ if (gpio->line >= 32)
return -EINVAL;
*reg = nv50_gpio_reg[gpio->line >> 3];
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [patch] nouveau: off by one in nv50_gpio_location()
2010-04-22 9:40 [patch] nouveau: off by one in nv50_gpio_location() Dan Carpenter
@ 2010-06-03 1:23 ` Ben Skeggs
0 siblings, 0 replies; 2+ messages in thread
From: Ben Skeggs @ 2010-06-03 1:23 UTC (permalink / raw)
To: Dan Carpenter; +Cc: David Airlie, dri-devel, kernel-janitors
On Thu, 2010-04-22 at 11:40 +0200, Dan Carpenter wrote:
> If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the
> end of the array.
Thanks, picked up in the nouveau tree.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
>
> diff --git a/drivers/gpu/drm/nouveau/nv50_gpio.c b/drivers/gpu/drm/nouveau/nv50_gpio.c
> index c61782b..bb47ad7 100644
> --- a/drivers/gpu/drm/nouveau/nv50_gpio.c
> +++ b/drivers/gpu/drm/nouveau/nv50_gpio.c
> @@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift)
> {
> const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
>
> - if (gpio->line > 32)
> + if (gpio->line >= 32)
> return -EINVAL;
>
> *reg = nv50_gpio_reg[gpio->line >> 3];
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-06-03 1:23 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-04-22 9:40 [patch] nouveau: off by one in nv50_gpio_location() Dan Carpenter
2010-06-03 1:23 ` Ben Skeggs
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).