gpio: grgpio: off by one in grgpio_to_irq()

PATCH In review Dan Carpenter 3 participants 3 messages Dec 16, 2014 – Jan 13, 2015

Subsystems (2)

Kernel janitors GPIO

lore

Share & tools

lore

Dan Carpenter

author

2014-12-16 23:53 UTC #0 lore raw

PATCH 1/1 gpio: grgpio: off by one in grgpio_to_irq()

"gc->ngpio" is a number between 1 and GRGPIO_MAX_NGPIO. If "offset" is GRGPIO_MAX_NGPIO then we're going one step beyond the end of the priv->lirqs[] array.

Signed-off-by Dan Carpenter <[email protected]>

drivers/gpio/gpio-grgpio.c +1 -1

index 09daaf2..d5bc70f 100644
@@ -121,7 +121,7 @@ static int grgpio_to_irq(struct gpio_chip *gc, unsigned offset)
 {
 	struct grgpio_priv *priv = grgpio_gc_to_priv(gc);
 
-	if (offset > gc->ngpio)
+	if (offset >= gc->ngpio)
 		return -ENXIO;
 
 	if (priv->lirqs[offset].index < 0)

Alexandre Courbot

Reviewed-by on v1 1/1

2014-12-17 02:18 UTC #1 lore raw

Quoted 5 lines · Dan Carpenter

"gc->ngpio" is a number between 1 and GRGPIO_MAX_NGPIO. If "offset" is GRGPIO_MAX_NGPIO then we're going one step beyond the end of the priv->lirqs[] array.
Signed-off-by Dan Carpenter <[email protected]>

Reviewed-by Alexandre Courbot <[email protected]>

Linus Walleij

2015-01-13 09:22 UTC #2 lore raw

In reply to Dan Carpenter

Quoted 5 lines · Dan Carpenter

"gc->ngpio" is a number between 1 and GRGPIO_MAX_NGPIO. If "offset" is GRGPIO_MAX_NGPIO then we're going one step beyond the end of the priv->lirqs[] array.
Signed-off-by Dan Carpenter <[email protected]>

Patch applied with Alex's ACK.

Yours,
Linus Walleij