nouveau: off by one in nv50_gpio_location()
authorDan Carpenter <error27@gmail.com>
Thu, 22 Apr 2010 09:40:53 +0000 (11:40 +0200)
committerDave Airlie <airlied@redhat.com>
Tue, 8 Jun 2010 01:03:31 +0000 (11:03 +1000)
If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the
end of the array.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
drivers/gpu/drm/nouveau/nv50_gpio.c

index c61782b314e799c59c2fc25972eaf8965169cbae..bb47ad737267a07ecfdc1071a6ebf7f2fdb6f9ec 100644 (file)
@@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift)
 {
        const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
 
-       if (gpio->line > 32)
+       if (gpio->line >= 32)
                return -EINVAL;
 
        *reg = nv50_gpio_reg[gpio->line >> 3];