projects
/
kernel
/
kernel-generic.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
6d69630
)
nouveau: off by one in nv50_gpio_location()
author
Dan Carpenter
<error27@gmail.com>
Thu, 22 Apr 2010 09:40:53 +0000
(11:40 +0200)
committer
Dave Airlie
<airlied@redhat.com>
Tue, 8 Jun 2010 01:03:31 +0000
(11:03 +1000)
If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the
end of the array.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
drivers/gpu/drm/nouveau/nv50_gpio.c
patch
|
blob
|
history
diff --git
a/drivers/gpu/drm/nouveau/nv50_gpio.c
b/drivers/gpu/drm/nouveau/nv50_gpio.c
index
c61782b
..
bb47ad7
100644
(file)
--- a/
drivers/gpu/drm/nouveau/nv50_gpio.c
+++ b/
drivers/gpu/drm/nouveau/nv50_gpio.c
@@
-31,7
+31,7
@@
nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift)
{
const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
- if (gpio->line > 32)
+ if (gpio->line >
=
32)
return -EINVAL;
*reg = nv50_gpio_reg[gpio->line >> 3];