From: Dan Carpenter Date: Thu, 12 Dec 2019 09:11:30 +0000 (+0300) Subject: drm/i915/bios: fix off by one in parse_generic_dtd() X-Git-Tag: v5.6-rc1~114^2~17^2~95 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8c8a854d6f43aacfaba49c116c426913bf416419;p=thirdparty%2Fkernel%2Flinux.git drm/i915/bios: fix off by one in parse_generic_dtd() The "num_dtd" variable is the number of elements in the generic_dtd->dtd[] array so the > needs to be >= to prevent reading one element beyond the end of the array. Fixes: 33ef6d4fd8df ("drm/i915/vbt: Handle generic DTD block") Reviewed-by: Matt Roper Signed-off-by: Dan Carpenter Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20191212091130.zf2g53njf5u24wk6@kili.mountain --- diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c index bd674fd355b77..54c02debeddf9 100644 --- a/drivers/gpu/drm/i915/display/intel_bios.c +++ b/drivers/gpu/drm/i915/display/intel_bios.c @@ -340,7 +340,7 @@ parse_generic_dtd(struct drm_i915_private *dev_priv, num_dtd = (get_blocksize(generic_dtd) - sizeof(struct bdb_generic_dtd)) / generic_dtd->gdtd_size; - if (dev_priv->vbt.panel_type > num_dtd) { + if (dev_priv->vbt.panel_type >= num_dtd) { DRM_ERROR("Panel type %d not found in table of %d DTD's\n", dev_priv->vbt.panel_type, num_dtd); return;