Commit df31ef4d authored by Marcin Slusarz's avatar Marcin Slusarz Committed by Ben Skeggs

drm/nouveau: fix pramdac_table range checking

get_tmds_index_reg reads some value from stack when mlv happens
to be equal to size of pramdac_table array. Fix it.
Reported-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarMarcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: default avatarFrancisco Jerez <currojerez@riseup.net>
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
parent a1606a95
...@@ -762,7 +762,7 @@ static uint32_t get_tmds_index_reg(struct drm_device *dev, uint8_t mlv) ...@@ -762,7 +762,7 @@ static uint32_t get_tmds_index_reg(struct drm_device *dev, uint8_t mlv)
dacoffset ^= 8; dacoffset ^= 8;
return 0x6808b0 + dacoffset; return 0x6808b0 + dacoffset;
} else { } else {
if (mlv > ARRAY_SIZE(pramdac_table)) { if (mlv >= ARRAY_SIZE(pramdac_table)) {
NV_ERROR(dev, "Magic Lookup Value too big (%02X)\n", NV_ERROR(dev, "Magic Lookup Value too big (%02X)\n",
mlv); mlv);
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment