* [PATCH] misc: vexpress: Off by one in vexpress_syscfg_exec()
@ 2018-12-03 14:52 Dan Carpenter
2018-12-03 16:28 ` Sudeep Holla
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2018-12-03 14:52 UTC (permalink / raw)
To: Arnd Bergmann, Pawel Moll
Cc: Greg Kroah-Hartman, Liviu Dudau, Sudeep Holla, Lorenzo Pieralisi,
linux-kernel, linux-arm-kernel, kernel-janitors
The > comparison should be >= to prevent reading beyond the end of the
func->template[] array.
(The func->template array is allocated in vexpress_syscfg_regmap_init()
and it has func->num_templates elements.)
Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/misc/vexpress-syscfg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/vexpress-syscfg.c b/drivers/misc/vexpress-syscfg.c
index 6c3591cdf855..a3c6c773d9dc 100644
--- a/drivers/misc/vexpress-syscfg.c
+++ b/drivers/misc/vexpress-syscfg.c
@@ -61,7 +61,7 @@ static int vexpress_syscfg_exec(struct vexpress_syscfg_func *func,
int tries;
long timeout;
- if (WARN_ON(index > func->num_templates))
+ if (WARN_ON(index >= func->num_templates))
return -EINVAL;
command = readl(syscfg->base + SYS_CFGCTRL);
--
2.11.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] misc: vexpress: Off by one in vexpress_syscfg_exec()
2018-12-03 14:52 [PATCH] misc: vexpress: Off by one in vexpress_syscfg_exec() Dan Carpenter
@ 2018-12-03 16:28 ` Sudeep Holla
0 siblings, 0 replies; 2+ messages in thread
From: Sudeep Holla @ 2018-12-03 16:28 UTC (permalink / raw)
To: Dan Carpenter
Cc: Arnd Bergmann, Pawel Moll, Greg Kroah-Hartman, Liviu Dudau,
Lorenzo Pieralisi, linux-kernel, linux-arm-kernel,
kernel-janitors, Sudeep Holla
On Mon, Dec 03, 2018 at 05:52:19PM +0300, Dan Carpenter wrote:
> The > comparison should be >= to prevent reading beyond the end of the
> func->template[] array.
>
> (The func->template array is allocated in vexpress_syscfg_regmap_init()
> and it has func->num_templates elements.)
>
> Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Good catch, thanks for identifying and fixing this.
Acked-by: Sudeep Holla <sudeep.holla@arm.com>
I assume Greg will pick this up, if not I will add this when I send
pull request next time(not sure when yet as I don't have anything for
v4.21)
--
Regards,
Sudeep
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-12-03 16:29 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-12-03 14:52 [PATCH] misc: vexpress: Off by one in vexpress_syscfg_exec() Dan Carpenter
2018-12-03 16:28 ` Sudeep Holla
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).