drm/nouveau: fix i2ctable bounds checking
authorMarcin Slusarz <marcin.slusarz@gmail.com>
Mon, 15 Feb 2010 22:24:49 +0000 (23:24 +0100)
committerBen Skeggs <bskeggs@redhat.com>
Thu, 25 Feb 2010 05:09:11 +0000 (15:09 +1000)
i2c_entries seems to be the number of i2c entries,
so with index equal to this number, we could read
invalid data from i2ctable. Fix it.

Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
drivers/gpu/drm/nouveau/nouveau_bios.c

index c1cee919b3cfacfbce378ff0d0bff04612f47178..ef2fe964e9ab86ecc4f3f816e405e6d2f771a9fb 100644 (file)
@@ -4984,7 +4984,8 @@ read_dcb_i2c_entry(struct drm_device *dev, int dcb_version, uint8_t *i2ctable, i
                else
                        NV_WARN(dev,
                                "DCB I2C table has more entries than indexable "
-                               "(%d entries, max index 15)\n", i2ctable[2]);
+                               "(%d entries, max %d)\n", i2ctable[2],
+                               DCB_MAX_NUM_I2C_ENTRIES);
                entry_len = i2ctable[3];
                /* [4] is i2c_default_indices, read in parse_dcb_table() */
        }
@@ -5000,8 +5001,8 @@ read_dcb_i2c_entry(struct drm_device *dev, int dcb_version, uint8_t *i2ctable, i
 
        if (index == 0xf)
                return 0;
-       if (index > i2c_entries) {
-               NV_ERROR(dev, "DCB I2C index too big (%d > %d)\n",
+       if (index >= i2c_entries) {
+               NV_ERROR(dev, "DCB I2C index too big (%d >= %d)\n",
                         index, i2ctable[2]);
                return -ENOENT;
        }