From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754982AbcITPQT (ORCPT ); Tue, 20 Sep 2016 11:16:19 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:56413 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752028AbcITPQS (ORCPT ); Tue, 20 Sep 2016 11:16:18 -0400 From: Colin King To: Alex Deucher , =?UTF-8?q?Christian=20K=C3=B6nig?= , David Airlie , Ken Wang , dri-devel@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org Subject: [PATCH] drm/amdgpu: avoid out of bounds access on array interrupt_status_offsets Date: Tue, 20 Sep 2016 16:16:12 +0100 Message-Id: <20160920151612.22249-1-colin.king@canonical.com> X-Mailer: git-send-email 2.9.3 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Colin Ian King The check for an out of bound index into array interrupt_status_offsets is off-by-one. Fix this and also don't compared to a hard coded array size but use ARRAY_SIZE instead. Signed-off-by: Colin Ian King --- drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c index d3512f3..4ce4c1a 100644 --- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c +++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c @@ -2782,7 +2782,7 @@ static int dce_v6_0_hpd_irq(struct amdgpu_device *adev, uint32_t disp_int, mask, int_control, tmp; unsigned hpd; - if (entry->src_data > 6) { + if (entry->src_data >= ARRAY_SIZE(interrupt_status_offsets)) { DRM_DEBUG("Unhandled interrupt: %d %d\n", entry->src_id, entry->src_data); return 0; } -- 2.9.3