Commit 55a4c5c5 authored by Dan Carpenter's avatar Dan Carpenter Committed by Dave Airlie

nouveau: off by one in nv50_gpio_location()

If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the
end of the array.
Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent 6d696305
...@@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift) ...@@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift)
{ {
const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 }; const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
if (gpio->line > 32) if (gpio->line >= 32)
return -EINVAL; return -EINVAL;
*reg = nv50_gpio_reg[gpio->line >> 3]; *reg = nv50_gpio_reg[gpio->line >> 3];
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment