Re: [PATCH] drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq()

[Harry Wentland <harry.wentland@xxxxxxx>]

On 2022-05-16 03:05, Dan Carpenter wrote:
> The > ARRAY_SIZE() should be >= ARRAY_SIZE() to prevent an out of bounds
> access.
> 
> Fixes: e27c41d5b068 ("drm/amd/display: Support for DMUB HPD interrupt handling")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>

Reviewed-by: Harry Wentland <harry.wentland@xxxxxxx>

Harry

> ---
>  drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> index 6edfc0963dab..c4f122c6faec 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> @@ -770,7 +770,7 @@ static void dm_dmub_outbox1_low_irq(void *interrupt_params)
>  
>  		do {
>  			dc_stat_get_dmub_notification(adev->dm.dc, &notify);
> -			if (notify.type > ARRAY_SIZE(dm->dmub_thread_offload)) {
> +			if (notify.type >= ARRAY_SIZE(dm->dmub_thread_offload)) {
>  				DRM_ERROR("DM: notify type %d invalid!", notify.type);
>  				continue;
>  			}