diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-12-03 17:52:19 +0300 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2019-04-04 16:13:47 +0100 |
| commit | 7fe29a1565321021652748f63406e3fe5f51ee3e (patch) | |
| tree | dcb7d04cb9af897fb20ffe9d5baef51de73721d5 | |
| parent | aeebd7582b278ea798ee4f50f14679da5273ed8e (diff) | |
| download | linux-stable-7fe29a1565321021652748f63406e3fe5f51ee3e.tar.gz linux-stable-7fe29a1565321021652748f63406e3fe5f51ee3e.tar.bz2 linux-stable-7fe29a1565321021652748f63406e3fe5f51ee3e.zip | |
misc: vexpress: Off by one in vexpress_syscfg_exec()
commit f8a70d8b889f180e6860cb1f85fed43d37844c5a upstream.
The > comparison should be >= to prevent reading beyond the end of the
func->template[] array.
(The func->template array is allocated in vexpress_syscfg_regmap_init()
and it has func->num_templates elements.)
Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | drivers/misc/vexpress-syscfg.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/misc/vexpress-syscfg.c b/drivers/misc/vexpress-syscfg.c index 3250fc1df0aa..26dc51990b55 100644 --- a/drivers/misc/vexpress-syscfg.c +++ b/drivers/misc/vexpress-syscfg.c @@ -61,7 +61,7 @@ static int vexpress_syscfg_exec(struct vexpress_syscfg_func *func, int tries; long timeout; - if (WARN_ON(index > func->num_templates)) + if (WARN_ON(index >= func->num_templates)) return -EINVAL; command = readl(syscfg->base + SYS_CFGCTRL); |