From: Harry Wentland Date: Fri, 10 Nov 2017 17:12:40 +0000 (-0500) Subject: drm/amd/display: Fix access of wrong array element TF format conversion X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=4d06ccd0af1ea5f3a3b74ca421b9cd9840d5e5c6;p=openwrt%2Fstaging%2Fblogic.git drm/amd/display: Fix access of wrong array element TF format conversion Found by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dce110/dce110_hw_sequencer.c:357 convert_to_custom_float() error: buffer overflow 'arr_points' 2 <= 2 drivers/gpu/drm/amd/amdgpu/../display/dc/dce110/dce110_hw_sequencer.c:358 convert_to_custom_float() warn: buffer overflow 'arr_points' 2 <= 2 Regression: drm/amd/display: Remove extra arr_points element Signed-off-by: Harry Wentland Reviewed-by: Tony Cheng Acked-by: Harry Wentland Signed-off-by: Alex Deucher --- diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c index 981bcd291602..21fc27aab909 100644 --- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c @@ -354,8 +354,8 @@ static bool convert_to_custom_float(struct pwl_result_data *rgb_resulted, return false; } - if (!convert_to_custom_float_format(arr_points[2].slope, &fmt, - &arr_points[2].custom_float_slope)) { + if (!convert_to_custom_float_format(arr_points[1].slope, &fmt, + &arr_points[1].custom_float_slope)) { BREAK_TO_DEBUGGER(); return false; }