diff options
| author | Marcin Slusarz <marcin.slusarz@gmail.com> | 2010-02-15 23:24:49 +0100 |
|---|---|---|
| committer | Ben Skeggs <bskeggs@redhat.com> | 2010-02-25 15:09:11 +1000 |
| commit | 761c5a69751967f4fe7430eb65b3a0ea92f3b673 (patch) | |
| tree | 4fef8a28592b49b047d9d17d6c9b6f77c3c42a9a | |
| parent | b762b8ce53da7c7a7a4d660878887681c86be61b (diff) | |
drm/nouveau: fix i2ctable bounds checking
i2c_entries seems to be the number of i2c entries,
so with index equal to this number, we could read
invalid data from i2ctable. Fix it.
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
| -rw-r--r-- | drivers/gpu/drm/nouveau/nouveau_bios.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c index c1cee919b3c..ef2fe964e9a 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c @@ -4984,7 +4984,8 @@ read_dcb_i2c_entry(struct drm_device *dev, int dcb_version, uint8_t *i2ctable, i else NV_WARN(dev, "DCB I2C table has more entries than indexable " - "(%d entries, max index 15)\n", i2ctable[2]); + "(%d entries, max %d)\n", i2ctable[2], + DCB_MAX_NUM_I2C_ENTRIES); entry_len = i2ctable[3]; /* [4] is i2c_default_indices, read in parse_dcb_table() */ } @@ -5000,8 +5001,8 @@ read_dcb_i2c_entry(struct drm_device *dev, int dcb_version, uint8_t *i2ctable, i if (index == 0xf) return 0; - if (index > i2c_entries) { - NV_ERROR(dev, "DCB I2C index too big (%d > %d)\n", + if (index >= i2c_entries) { + NV_ERROR(dev, "DCB I2C index too big (%d >= %d)\n", index, i2ctable[2]); return -ENOENT; } |