get_gpio_i2c_info() computes the number of GPIO I2C assignment records
present in the BIOS table and then uses bfI2C_LineMux as an array index
into header->asGPIO_Info[]. The current check only rejects values
strictly larger than the record count, so an index equal to count still
falls through and reaches the fixed table one element past the end.

Reject indices at or above the number of available records before using
them as an array index.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
index 8b3084cc59fd..85c8f5479a52 100644
--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
+++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
@@ -1952,7 +1952,7 @@ static enum bp_result get_gpio_i2c_info(struct bios_parser *bp,
 	count = (le16_to_cpu(header->sHeader.usStructureSize)
 			- sizeof(ATOM_COMMON_TABLE_HEADER))
 				/ sizeof(ATOM_GPIO_I2C_ASSIGMENT);
-	if (count < record->sucI2cId.bfI2C_LineMux)
+	if (count <= record->sucI2cId.bfI2C_LineMux)
 		return BP_RESULT_BADBIOSTABLE;
 
 	/* get the GPIO_I2C_INFO */
-- 
2.50.1 (Apple Git-155)

Applied.  Thanks!

On Thu, Mar 26, 2026 at 9:18 AM Pengpeng Hou <pengpeng@iscas.ac.cn> wrote:
>
> get_gpio_i2c_info() computes the number of GPIO I2C assignment records
> present in the BIOS table and then uses bfI2C_LineMux as an array index
> into header->asGPIO_Info[]. The current check only rejects values
> strictly larger than the record count, so an index equal to count still
> falls through and reaches the fixed table one element past the end.
>
> Reject indices at or above the number of available records before using
> them as an array index.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
> index 8b3084cc59fd..85c8f5479a52 100644
> --- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
> +++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
> @@ -1952,7 +1952,7 @@ static enum bp_result get_gpio_i2c_info(struct bios_parser *bp,
>         count = (le16_to_cpu(header->sHeader.usStructureSize)
>                         - sizeof(ATOM_COMMON_TABLE_HEADER))
>                                 / sizeof(ATOM_GPIO_I2C_ASSIGMENT);
> -       if (count < record->sucI2cId.bfI2C_LineMux)
> +       if (count <= record->sucI2cId.bfI2C_LineMux)
>                 return BP_RESULT_BADBIOSTABLE;
>
>         /* get the GPIO_I2C_INFO */
> --
> 2.50.1 (Apple Git-155)
>