Skip to contentSkip to conversation

phy: stm32-usphyc: Fix off by one in probe()

PATCH Applied Dan Carpenter 3 participants 3 messages Dec 9, 2025 – Dec 23, 2025

Subsystems (3)
Kernel janitors Arm STM32 Generic PHY framework
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 phy: stm32-usphyc: Fix off by one in probe()

The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one element out of bounds. The "index" comes from the device tree so it's data that we trust and it's unlikely to be wrong, however it's obviously still worth fixing the bug. Change the > to >=.

Fixes 94c358da3a05 ("phy: stm32: add support for STM32 USB PHY Controller (USBPHYC)")
Signed-off-by Dan Carpenter <[email protected]>
---
 drivers/phy/st/phy-stm32-usbphyc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/st/phy-stm32-usbphyc.c +1 -1
index 27fe92f73f33..b44afbff8616 100644
@@ -712,7 +712,7 @@ static int stm32_usbphyc_probe(struct platform_device *pdev)
 		}
 
 		ret = of_property_read_u32(child, "reg", &index);
-		if (ret || index > usbphyc->nphys) {
+		if (ret || index >= usbphyc->nphys) {
 			dev_err(&phy->dev, "invalid reg property: %d\n", ret);
 			if (!ret)
 				ret = -EINVAL;
Signature · 1 line
2.51.0
Reviewed-by on v1 1/1
#1 lore raw
Quoted 8 lines · Dan Carpenter

The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one element out of bounds. The "index" comes from the device tree so it's data that we trust and it's unlikely to be wrong, however it's obviously still worth fixing the bug. Change the > to >=.

Fixes 94c358da3a05 ("phy: stm32: add support for STM32 USB PHY Controller (USBPHYC)")
Signed-off-by Dan Carpenter <[email protected]>

Hi Dan, thanks for your patch.

Reviewed-by Amelie Delaunay <[email protected]>
Quoted 17 lines
---
  drivers/phy/st/phy-stm32-usbphyc.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/st/phy-stm32-usbphyc.c +1 -1
index 27fe92f73f33..b44afbff8616 100644
@@ -712,7 +712,7 @@ static int stm32_usbphyc_probe(struct platform_device *pdev)
  		}
 
  		ret = of_property_read_u32(child, "reg", &index);
-		if (ret || index > usbphyc->nphys) {
+		if (ret || index >= usbphyc->nphys) {
  			dev_err(&phy->dev, "invalid reg property: %d\n", ret);
  			if (!ret)
  				ret = -EINVAL;
Signature · 3 lines
linux-phy mailing list
[email protected]
https://lists.infradead.org/mailman/listinfo/linux-phy
maintainer Applied
#2 lore raw
In reply to Dan Carpenter
Quoted 8 lines · Dan Carpenter

The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one element out of bounds. The "index" comes from the device tree so it's data that we trust and it's unlikely to be wrong, however it's obviously still worth fixing the bug. Change the > to >=.

[...]

Applied, thanks!

[1/1] phy: stm32-usphyc: Fix off by one in probe()

      commit: cabd25b57216ddc132efbcc31f972baa03aad15a

Best regards,

Signature · 1 line
~Vinod