| Message ID | 20200218055247.74s2xa7veqx2do34@kili.mountain |
|---|---|
| State | New |
| Headers | show |
| Series | pinctrl: mediatek: Fix some off by one bugs | expand |
On Tue, Feb 18, 2020 at 6:55 AM Dan Carpenter <dan.carpenter@oracle.com> wrote: > These comparisons should be >= instead of > to prevent accessing one > element beyond the end of the hw->soc->pins[] array. > > Fixes: 3de7deefce69 ("pinctrl: mediatek: Check gpio pin number and use binary search in mtk_hw_pin_field_lookup()") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Matthias could you have a look at this patch? Yours, Linus Walleij
On 20/02/2020 16:14, Linus Walleij wrote: > On Tue, Feb 18, 2020 at 6:55 AM Dan Carpenter <dan.carpenter@oracle.com> wrote: > >> These comparisons should be >= instead of > to prevent accessing one >> element beyond the end of the hw->soc->pins[] array. >> >> Fixes: 3de7deefce69 ("pinctrl: mediatek: Check gpio pin number and use binary search in mtk_hw_pin_field_lookup()") >> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > Matthias could you have a look at this patch? > From what I see hw->soc->npins is the ARRAY_SIZE() of the pins. So the index should smaller hw->soc->npins. Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
On 20/02/2020 21:24, Matthias Brugger wrote: > > > On 20/02/2020 16:14, Linus Walleij wrote: >> On Tue, Feb 18, 2020 at 6:55 AM Dan Carpenter <dan.carpenter@oracle.com> wrote: >> >>> These comparisons should be >= instead of > to prevent accessing one >>> element beyond the end of the hw->soc->pins[] array. >>> >>> Fixes: 3de7deefce69 ("pinctrl: mediatek: Check gpio pin number and use binary search in mtk_hw_pin_field_lookup()") >>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> >> >> Matthias could you have a look at this patch? >> > > From what I see hw->soc->npins is the ARRAY_SIZE() of the pins. So the index > should smaller hw->soc->npins. > > Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com> > Actually missing a second Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.") Regards, Matthias
On Tue, Feb 18, 2020 at 6:55 AM Dan Carpenter <dan.carpenter@oracle.com> wrote: > These comparisons should be >= instead of > to prevent accessing one > element beyond the end of the hw->soc->pins[] array. > > Fixes: 3de7deefce69 ("pinctrl: mediatek: Check gpio pin number and use binary search in mtk_hw_pin_field_lookup()") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Patch applied as a non-critical fix with Matthias' Review tag. Yours, Linus Walleij
diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c index 83bf29c7ce7e..53f8a14fe542 100644 --- a/drivers/pinctrl/mediatek/pinctrl-paris.c +++ b/drivers/pinctrl/mediatek/pinctrl-paris.c @@ -544,7 +544,7 @@ static int mtk_hw_get_value_wrap(struct mtk_pinctrl *hw, unsigned int gpio, int const struct mtk_pin_desc *desc; int value, err; - if (gpio > hw->soc->npins) + if (gpio >= hw->soc->npins) return -EINVAL; desc = (const struct mtk_pin_desc *)&hw->soc->pins[gpio]; @@ -583,7 +583,7 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw, int pinmux, pullup, pullen, len = 0, r1 = -1, r0 = -1; const struct mtk_pin_desc *desc; - if (gpio > hw->soc->npins) + if (gpio >= hw->soc->npins) return -EINVAL; desc = (const struct mtk_pin_desc *)&hw->soc->pins[gpio]; @@ -766,7 +766,7 @@ static int mtk_gpio_get_direction(struct gpio_chip *chip, unsigned int gpio) const struct mtk_pin_desc *desc; int value, err; - if (gpio > hw->soc->npins) + if (gpio >= hw->soc->npins) return -EINVAL; desc = (const struct mtk_pin_desc *)&hw->soc->pins[gpio]; @@ -784,7 +784,7 @@ static int mtk_gpio_get(struct gpio_chip *chip, unsigned int gpio) const struct mtk_pin_desc *desc; int value, err; - if (gpio > hw->soc->npins) + if (gpio >= hw->soc->npins) return -EINVAL; desc = (const struct mtk_pin_desc *)&hw->soc->pins[gpio]; @@ -801,7 +801,7 @@ static void mtk_gpio_set(struct gpio_chip *chip, unsigned int gpio, int value) struct mtk_pinctrl *hw = gpiochip_get_data(chip); const struct mtk_pin_desc *desc; - if (gpio > hw->soc->npins) + if (gpio >= hw->soc->npins) return; desc = (const struct mtk_pin_desc *)&hw->soc->pins[gpio]; @@ -813,7 +813,7 @@ static int mtk_gpio_direction_input(struct gpio_chip *chip, unsigned int gpio) { struct mtk_pinctrl *hw = gpiochip_get_data(chip); - if (gpio > hw->soc->npins) + if (gpio >= hw->soc->npins) return -EINVAL; return pinctrl_gpio_direction_input(chip->base + gpio); @@ -824,7 +824,7 @@ static int mtk_gpio_direction_output(struct gpio_chip *chip, unsigned int gpio, { struct mtk_pinctrl *hw = gpiochip_get_data(chip); - if (gpio > hw->soc->npins) + if (gpio >= hw->soc->npins) return -EINVAL; mtk_gpio_set(chip, gpio, value);
These comparisons should be >= instead of > to prevent accessing one element beyond the end of the hw->soc->pins[] array. Fixes: 3de7deefce69 ("pinctrl: mediatek: Check gpio pin number and use binary search in mtk_hw_pin_field_lookup()") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/pinctrl/mediatek/pinctrl-paris.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)