From: Ben Skeggs Subject: Re: [patch] nouveau: off by one in nv50_gpio_location() Date: Thu, 03 Jun 2010 11:23:16 +1000 Message-ID: <1275528196.9064.1.camel@nisroch> References: <20100422094053.GL29647@bicker> Reply-To: bskeggs@redhat.com Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20100422094053.GL29647@bicker> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.sourceforge.net To: Dan Carpenter Cc: David Airlie , dri-devel@lists.sourceforge.net, kernel-janitors@vger.kernel.org List-Id: dri-devel@lists.freedesktop.org On Thu, 2010-04-22 at 11:40 +0200, Dan Carpenter wrote: > If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the > end of the array. Thanks, picked up in the nouveau tree. > > Signed-off-by: Dan Carpenter > > diff --git a/drivers/gpu/drm/nouveau/nv50_gpio.c b/drivers/gpu/drm/nouveau/nv50_gpio.c > index c61782b..bb47ad7 100644 > --- a/drivers/gpu/drm/nouveau/nv50_gpio.c > +++ b/drivers/gpu/drm/nouveau/nv50_gpio.c > @@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift) > { > const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 }; > > - if (gpio->line > 32) > + if (gpio->line >= 32) > return -EINVAL; > > *reg = nv50_gpio_reg[gpio->line >> 3]; ------------------------------------------------------------------------------ ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win: http://p.sf.net/sfu/thinkgeek-promo --