diff options
| author | Grant Likely <grant.likely@linaro.org> | 2014-11-19 16:22:32 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-12-06 15:57:29 -0800 |
| commit | 1f8d238e13cd3bdc43b1c2623755347a24f4ce7e (patch) | |
| tree | b7e18df1f043f2b14c5178ea9e29b01ace13daa2 | |
| parent | b7b660a4ddc1c09b6eec40a5c211d7082aaa2dd4 (diff) | |
| download | linux-stable-1f8d238e13cd3bdc43b1c2623755347a24f4ce7e.tar.gz linux-stable-1f8d238e13cd3bdc43b1c2623755347a24f4ce7e.tar.bz2 linux-stable-1f8d238e13cd3bdc43b1c2623755347a24f4ce7e.zip | |
of/selftest: Fix off-by-one error in removal path
commit c1a2086e2d8c4eb4e8630ba752e911ec180dec67 upstream.
The removal path for selftest data has an off by one error that causes
the code to dereference beyond the end of the nodes[] array on the first
pass through. The old code only worked by chance on a lot of platforms,
but the bug was recently exposed on aarch64.
The fix is simple. Decrement the node count before dereferencing, not
after.
Reported-by: Kevin Hilman <khilman@linaro.org>
Cc: Rob Herring <robh+dt@kernel.org>
Cc: Gaurav Minocha <gaurav.minocha.os@gmail.com>
| -rw-r--r-- | drivers/of/selftest.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c index c92de69fcf7f..612a51214a66 100644 --- a/drivers/of/selftest.c +++ b/drivers/of/selftest.c @@ -799,7 +799,7 @@ static void selftest_data_remove(void) return; } - while (last_node_index >= 0) { + while (last_node_index-- > 0) { if (nodes[last_node_index]) { np = of_find_node_by_path(nodes[last_node_index]->full_name); if (strcmp(np->full_name, "/aliases") != 0) { @@ -812,7 +812,6 @@ static void selftest_data_remove(void) } } } - last_node_index--; } } |