Skip to content

Commit

Permalink
nouveau: off by one in nv50_gpio_location()
Browse files Browse the repository at this point in the history
If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the
end of the array.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
  • Loading branch information
error27 authored and airlied committed Jun 8, 2010
1 parent 6d69630 commit 55a4c5c
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/gpu/drm/nouveau/nv50_gpio.c
Expand Up @@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift)
{
const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };

if (gpio->line > 32)
if (gpio->line >= 32)
return -EINVAL;

*reg = nv50_gpio_reg[gpio->line >> 3];
Expand Down

0 comments on commit 55a4c5c

Please sign in to comment.