Skip to contentSkip to conversation

ns2: Fix off by one bugs in ns2_pinmux_enable()

PATCH In review Dan Carpenter 3 participants 3 messages Sep 26, 2019 – Oct 4, 2019

Subsystems (4)
Kernel janitors GPIO Pin control Broadcom iproc Arm architecture
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 ns2: Fix off by one bugs in ns2_pinmux_enable()

The pinctrl->functions[] array has pinctrl->num_functions elements and the pinctrl->groups[] array is the same way. These are set in ns2_pinmux_probe(). So the > comparisons should be >= so that we don't read one element beyond the end of the array.

Fixes b5aa1006e4a9 ("pinctrl: ns2: add pinmux driver support for Broadcom NS2 SoC")
Signed-off-by Dan Carpenter <[email protected]>
---
 drivers/pinctrl/bcm/pinctrl-ns2-mux.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/bcm/pinctrl-ns2-mux.c +2 -2
index 2bf6af7df7d9..9fabc451550e 100644
@@ -640,8 +640,8 @@ static int ns2_pinmux_enable(struct pinctrl_dev *pctrl_dev,
 	const struct ns2_pin_function *func;
 	const struct ns2_pin_group *grp;
 
-	if (grp_select > pinctrl->num_groups ||
-		func_select > pinctrl->num_functions)
+	if (grp_select >= pinctrl->num_groups ||
+		func_select >= pinctrl->num_functions)
 		return -EINVAL;
 
 	func = &pinctrl->functions[func_select];
Signature · 1 line
2.20.1
Acked-by on v1 1/1
#1 lore raw

thanks for fix.

Quoted 7 lines · Dan Carpenter

The pinctrl->functions[] array has pinctrl->num_functions elements and the pinctrl->groups[] array is the same way. These are set in ns2_pinmux_probe(). So the > comparisons should be >= so that we don't read one element beyond the end of the array.

Fixes b5aa1006e4a9 ("pinctrl: ns2: add pinmux driver support for Broadcom NS2 SoC")
Signed-off-by Dan Carpenter <[email protected]>
Acked-by Scott Branden <[email protected]>
Quoted 19 lines
---
  drivers/pinctrl/bcm/pinctrl-ns2-mux.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/bcm/pinctrl-ns2-mux.c +2 -2
index 2bf6af7df7d9..9fabc451550e 100644
@@ -640,8 +640,8 @@ static int ns2_pinmux_enable(struct pinctrl_dev *pctrl_dev,
  	const struct ns2_pin_function *func;
  	const struct ns2_pin_group *grp;
 
-	if (grp_select > pinctrl->num_groups ||
-		func_select > pinctrl->num_functions)
+	if (grp_select >= pinctrl->num_groups ||
+		func_select >= pinctrl->num_functions)
  		return -EINVAL;
 
  	func = &pinctrl->functions[func_select];
#2 lore raw
In reply to Dan Carpenter
Quoted 7 lines · Dan Carpenter

The pinctrl->functions[] array has pinctrl->num_functions elements and the pinctrl->groups[] array is the same way. These are set in ns2_pinmux_probe(). So the > comparisons should be >= so that we don't read one element beyond the end of the array.

Fixes b5aa1006e4a9 ("pinctrl: ns2: add pinmux driver support for Broadcom NS2 SoC")
Signed-off-by Dan Carpenter <[email protected]>

Patch applied with Scott's ACK.

Yours,
Linus Walleij