| Message ID | 20181203145219.brmtuv26dj3vnc5y@kili.mountain (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | misc: vexpress: Off by one in vexpress_syscfg_exec() | expand |
On Mon, Dec 03, 2018 at 05:52:19PM +0300, Dan Carpenter wrote: > The > comparison should be >= to prevent reading beyond the end of the > func->template[] array. > > (The func->template array is allocated in vexpress_syscfg_regmap_init() > and it has func->num_templates elements.) > > Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Good catch, thanks for identifying and fixing this. Acked-by: Sudeep Holla <sudeep.holla@arm.com> I assume Greg will pick this up, if not I will add this when I send pull request next time(not sure when yet as I don't have anything for v4.21) -- Regards, Sudeep
diff --git a/drivers/misc/vexpress-syscfg.c b/drivers/misc/vexpress-syscfg.c index 6c3591cdf855..a3c6c773d9dc 100644 --- a/drivers/misc/vexpress-syscfg.c +++ b/drivers/misc/vexpress-syscfg.c @@ -61,7 +61,7 @@ static int vexpress_syscfg_exec(struct vexpress_syscfg_func *func, int tries; long timeout; - if (WARN_ON(index > func->num_templates)) + if (WARN_ON(index >= func->num_templates)) return -EINVAL; command = readl(syscfg->base + SYS_CFGCTRL);
The > comparison should be >= to prevent reading beyond the end of the func->template[] array. (The func->template array is allocated in vexpress_syscfg_regmap_init() and it has func->num_templates elements.) Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/misc/vexpress-syscfg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)