提交 55a4c5c5 编写于 作者: D Dan Carpenter 提交者: Dave Airlie

nouveau: off by one in nv50_gpio_location()

If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the
end of the array.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>
上级 6d696305
...@@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift) ...@@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift)
{ {
const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 }; const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
if (gpio->line > 32) if (gpio->line >= 32)
return -EINVAL; return -EINVAL;
*reg = nv50_gpio_reg[gpio->line >> 3]; *reg = nv50_gpio_reg[gpio->line >> 3];
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册