Applied. Thanks!
On Thu, Mar 26, 2026 at 9:18 AM Pengpeng Hou <[email protected]> wrote: > > get_gpio_i2c_info() computes the number of GPIO I2C assignment records > present in the BIOS table and then uses bfI2C_LineMux as an array index > into header->asGPIO_Info[]. The current check only rejects values > strictly larger than the record count, so an index equal to count still > falls through and reaches the fixed table one element past the end. > > Reject indices at or above the number of available records before using > them as an array index. > > Signed-off-by: Pengpeng Hou <[email protected]> > --- > drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c > b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c > index 8b3084cc59fd..85c8f5479a52 100644 > --- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c > +++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c > @@ -1952,7 +1952,7 @@ static enum bp_result get_gpio_i2c_info(struct > bios_parser *bp, > count = (le16_to_cpu(header->sHeader.usStructureSize) > - sizeof(ATOM_COMMON_TABLE_HEADER)) > / sizeof(ATOM_GPIO_I2C_ASSIGMENT); > - if (count < record->sucI2cId.bfI2C_LineMux) > + if (count <= record->sucI2cId.bfI2C_LineMux) > return BP_RESULT_BADBIOSTABLE; > > /* get the GPIO_I2C_INFO */ > -- > 2.50.1 (Apple Git-155) >
