drm/amdgpu: avoid out of bounds access on array interrupt_status_offsets
authorColin Ian King <colin.king@canonical.com>
Tue, 20 Sep 2016 15:49:31 +0000 (16:49 +0100)
committerAlex Deucher <alexander.deucher@amd.com>
Thu, 22 Sep 2016 14:24:17 +0000 (10:24 -0400)
The check for an out of bound index into array interrupt_status_offsets
is off-by-one. Fix this and also don't compared to a hard coded array
size but use adev->mode_info.num_hpd instead.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c

index ec5d8d9..c8380f0 100644 (file)
@@ -2782,7 +2782,7 @@ static int dce_v6_0_hpd_irq(struct amdgpu_device *adev,
        uint32_t disp_int, mask, int_control, tmp;
        unsigned hpd;
 
-       if (entry->src_data > 6) {
+       if (entry->src_data >= adev->mode_info.num_hpd) {
                DRM_DEBUG("Unhandled interrupt: %d %d\n", entry->src_id, entry->src_data);
                return 0;
        }