diff options
| author | Dan Carpenter | 2010-04-22 11:40:53 +0200 |
|---|---|---|
| committer | Dave Airlie | 2010-06-08 11:03:31 +1000 |
| commit | 55a4c5c515c1f4b4bde00c443e71ff9f3822013e (patch) | |
| tree | dbb2d3da6e010a794b25177a8c76af515e89dc14 /drivers/gpu | |
| parent | 6d696305530c0b3fcd7d15ad87d7203cb53df5b7 (diff) | |
nouveau: off by one in nv50_gpio_location()
If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the
end of the array.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/nouveau/nv50_gpio.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/nouveau/nv50_gpio.c b/drivers/gpu/drm/nouveau/nv50_gpio.c index c61782b314e7..bb47ad737267 100644 --- a/drivers/gpu/drm/nouveau/nv50_gpio.c +++ b/drivers/gpu/drm/nouveau/nv50_gpio.c @@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift) { const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 }; - if (gpio->line > 32) + if (gpio->line >= 32) return -EINVAL; *reg = nv50_gpio_reg[gpio->line >> 3]; |