From patchwork Wed Jul 27 09:53:40 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 1011112 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by demeter2.kernel.org (8.14.4/8.14.4) with ESMTP id p6R9u0MV005855 for ; Wed, 27 Jul 2011 09:56:20 GMT Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 907A59F67C for ; Wed, 27 Jul 2011 02:55:59 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-pz0-f47.google.com (mail-pz0-f47.google.com [209.85.210.47]) by gabe.freedesktop.org (Postfix) with ESMTP id 5CBE19F615 for ; Wed, 27 Jul 2011 02:55:39 -0700 (PDT) Received: by pzk36 with SMTP id 36so2380387pzk.34 for ; Wed, 27 Jul 2011 02:55:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:mime-version:content-type :content-disposition:user-agent; bh=ZrJzrTJ8s8q8NV8wJb5eTAn6NUO5eGMBxHZYFvLjtyk=; b=IN4HWrvoXooYCJUuxKISA8mzzi3MS3U8mGv06qVeBrkYA2U/kDerKKtdD8GHmaqBGP pN8K2LaVhzrlLE57RXIoW1MhPcodJThZbMAJs2/90L9UFtSHipcWX8hAajKf8Sg0mZjj qW3bmBEgewiTghggQNy6+A4mT4vF5FYZDu0jE= Received: by 10.68.9.193 with SMTP id c1mr10859595pbb.27.1311760538845; Wed, 27 Jul 2011 02:55:38 -0700 (PDT) Received: from shale.localdomain ([41.139.221.94]) by mx.google.com with ESMTPS id d3sm1515527pbh.85.2011.07.27.02.55.33 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 27 Jul 2011 02:55:38 -0700 (PDT) Date: Wed, 27 Jul 2011 12:53:40 +0300 From: Dan Carpenter To: David Airlie Subject: [patch] drm/radeon: off by one in check_reg() functions Message-ID: <20110727095340.GK3824@shale.localdomain> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Cc: kernel-janitors@vger.kernel.org, "open list:DRM DRIVERS" X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org Errors-To: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter2.kernel.org [140.211.167.43]); Wed, 27 Jul 2011 09:56:20 +0000 (UTC) This off by one range check was copy and pasted a couple places. It's not really harmful, but we should fix it anyway. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c index db8ef19..cf83aa0 100644 --- a/drivers/gpu/drm/radeon/r600_cs.c +++ b/drivers/gpu/drm/radeon/r600_cs.c @@ -915,12 +915,11 @@ static inline int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx { struct r600_cs_track *track = (struct r600_cs_track *)p->track; struct radeon_cs_reloc *reloc; - u32 last_reg = ARRAY_SIZE(r600_reg_safe_bm); u32 m, i, tmp, *ib; int r; i = (reg >> 7); - if (i > last_reg) { + if (i >= ARRAY_SIZE(r600_reg_safe_bm)) { dev_warn(p->dev, "forbidden register 0x%08x at %d\n", reg, idx); return -EINVAL; } diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c index 189e865..a134790 100644 --- a/drivers/gpu/drm/radeon/evergreen_cs.c +++ b/drivers/gpu/drm/radeon/evergreen_cs.c @@ -428,7 +428,7 @@ static inline int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u3 last_reg = ARRAY_SIZE(evergreen_reg_safe_bm); i = (reg >> 7); - if (i > last_reg) { + if (i >= last_reg) { dev_warn(p->dev, "forbidden register 0x%08x at %d\n", reg, idx); return -EINVAL; }