All of lore.kernel.org
 help / color / mirror / Atom feed
From: Colin King <colin.king@canonical.com>
To: Andy Gross <agross@kernel.org>,
	Bjorn Andersson <bjorn.andersson@linaro.org>,
	Dmitry Baryshkov <dmitry.baryshkov@linaro.org>,
	linux-arm-msm@vger.kernel.org
Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] soc: qcom: socinfo: Fix off-by-one array index bounds check
Date: Mon, 18 Jan 2021 11:36:51 +0000	[thread overview]
Message-ID: <20210118113651.71955-1-colin.king@canonical.com> (raw)

From: Colin Ian King <colin.king@canonical.com>

There is an off-by-one array index bounds check on array
pmic_models. Fix this by checking using < rather than <= on
the array size.

Addresses-Coverity: ("Out-of-bounds read")
Fixes: 734c78e7febf ("soc: qcom: socinfo: add info from PMIC models array")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/soc/qcom/socinfo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c
index a985ed064669..f449df560d93 100644
--- a/drivers/soc/qcom/socinfo.c
+++ b/drivers/soc/qcom/socinfo.c
@@ -332,7 +332,7 @@ static int qcom_show_pmic_model_array(struct seq_file *seq, void *p)
 		unsigned int model = SOCINFO_MINOR(get_unaligned_le32(ptr + 2 * i * sizeof(u32)));
 		unsigned int die_rev = get_unaligned_le32(ptr + (2 * i + 1) * sizeof(u32));
 
-		if (model <= ARRAY_SIZE(pmic_models) && pmic_models[model])
+		if (model < ARRAY_SIZE(pmic_models) && pmic_models[model])
 			seq_printf(seq, "%s %u.%u\n", pmic_models[model],
 				   SOCINFO_MAJOR(le32_to_cpu(die_rev)),
 				   SOCINFO_MINOR(le32_to_cpu(die_rev)));
-- 
2.29.2


             reply	other threads:[~2021-01-18 19:54 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-18 11:36 Colin King [this message]
2021-01-20  9:57 ` [PATCH] soc: qcom: socinfo: Fix an off by one in qcom_show_pmic_model() Dan Carpenter
2021-01-20  9:57   ` Dan Carpenter
2021-01-20 16:25   ` Doug Anderson
2021-01-20 16:25     ` Doug Anderson
2021-01-20 17:55   ` Dmitry Baryshkov
2021-01-20 17:55     ` Dmitry Baryshkov
2021-01-20 18:32   ` Stephen Boyd
2021-01-20 18:32     ` Stephen Boyd
2021-01-21  4:50   ` patchwork-bot+linux-arm-msm
2021-01-20  9:58 ` [PATCH] soc: qcom: socinfo: Fix off-by-one array index bounds check Dan Carpenter
2021-01-20  9:58   ` Dan Carpenter
2021-01-21  4:50 ` patchwork-bot+linux-arm-msm

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210118113651.71955-1-colin.king@canonical.com \
    --to=colin.king@canonical.com \
    --cc=agross@kernel.org \
    --cc=bjorn.andersson@linaro.org \
    --cc=dmitry.baryshkov@linaro.org \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=linux-arm-msm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.