Skip to contentSkip to conversation

nouveau: off by one in nv50_gpio_location()

PATCH In review Dan Carpenter 2 participants 2 messages Apr 22, 2010 – Jun 3, 2010

Subsystems (4)
DRM drivers DRM misc Kernel janitors nouveau
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 nouveau: off by one in nv50_gpio_location()

If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the end of the array.

Signed-off-by Dan Carpenter <[email protected]>
drivers/gpu/drm/nouveau/nv50_gpio.c +1 -1
index c61782b..bb47ad7 100644
@@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift)
 {
 	const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
 
-	if (gpio->line > 32)
+	if (gpio->line >= 32)
 		return -EINVAL;
 
 	*reg = nv50_gpio_reg[gpio->line >> 3];

------------------------------------------------------------------------------
--

#1 lore raw
Quoted 2 lines · Dan Carpenter

If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the end of the array.

Thanks, picked up in the nouveau tree.

Quoted 8 lines
Signed-off-by Dan Carpenter <[email protected]>
drivers/gpu/drm/nouveau/nv50_gpio.c +0 -0
index c61782b..bb47ad7 100644

drivers/gpu/drm/nouveau/nv50_gpio.c nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift) · line 37

Quoted 8 lines
drivers/gpu/drm/nouveau/nv50_gpio.c +1 -1
@@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift)
 {
 	const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
 
-	if (gpio->line > 32)
+	if (gpio->line >= 32)
 		return -EINVAL;
 
 	*reg = nv50_gpio_reg[gpio->line >> 3];

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
--