From: Dan Carpenter <error27@gmail.com>
Date: Thu, 22 Apr 2010 09:40:53 +0000 (+0200)
Subject: nouveau: off by one in nv50_gpio_location()
X-Git-Tag: v2.6.35-rc3~23^2~4
X-Git-Url: https://bbs.cooldavid.org/git/?a=commitdiff_plain;h=55a4c5c515c1f4b4bde00c443e71ff9f3822013e;p=net-next-2.6.git

nouveau: off by one in nv50_gpio_location()

If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the
end of the array.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
---

diff --git a/drivers/gpu/drm/nouveau/nv50_gpio.c b/drivers/gpu/drm/nouveau/nv50_gpio.c
index c61782b314e..bb47ad73726 100644
--- a/drivers/gpu/drm/nouveau/nv50_gpio.c
+++ b/drivers/gpu/drm/nouveau/nv50_gpio.c
@@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift)
 {
 	const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
 
-	if (gpio->line > 32)
+	if (gpio->line >= 32)
 		return -EINVAL;
 
 	*reg = nv50_gpio_reg[gpio->line >> 3];