mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 09:19:51 +00:00
nouveau: off by one in nv50_gpio_location()
If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the end of the array. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
This commit is contained in:
parent
6d69630553
commit
55a4c5c515
1 changed files with 1 additions and 1 deletions
|
@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift)
|
|||
{
|
||||
const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
|
||||
|
||||
if (gpio->line > 32)
|
||||
if (gpio->line >= 32)
|
||||
return -EINVAL;
|
||||
|
||||
*reg = nv50_gpio_reg[gpio->line >> 3];
|
||||
|
|
Loading…
Reference in a new issue