Re: [PATCH] drm/amd/display: bios_parser: fix GPIO I2C line off-by-one

[Alex Deucher]

Applied.  Thanks!

On Thu, Mar 26, 2026 at 9:18 AM Pengpeng Hou <pengpeng@xxxxxxxxxxx> wrote:
>
> get_gpio_i2c_info() computes the number of GPIO I2C assignment records
> present in the BIOS table and then uses bfI2C_LineMux as an array index
> into header->asGPIO_Info[]. The current check only rejects values
> strictly larger than the record count, so an index equal to count still
> falls through and reaches the fixed table one element past the end.
>
> Reject indices at or above the number of available records before using
> them as an array index.
>
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> ---
>  drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
> index 8b3084cc59fd..85c8f5479a52 100644
> --- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
> +++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
> @@ -1952,7 +1952,7 @@ static enum bp_result get_gpio_i2c_info(struct bios_parser *bp,
>         count = (le16_to_cpu(header->sHeader.usStructureSize)
>                         - sizeof(ATOM_COMMON_TABLE_HEADER))
>                                 / sizeof(ATOM_GPIO_I2C_ASSIGMENT);
> -       if (count < record->sucI2cId.bfI2C_LineMux)
> +       if (count <= record->sucI2cId.bfI2C_LineMux)
>                 return BP_RESULT_BADBIOSTABLE;
>
>         /* get the GPIO_I2C_INFO */
> --
> 2.50.1 (Apple Git-155)
>