| Message ID | 92a6a5cb-3a89-4c06-a91e-438cfda76fae@kili.mountain |
|---|---|
| State | Handled Elsewhere |
| Headers | show |
| Series | hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id() | expand |
On 4/19/23 7:30 AM, Dan Carpenter wrote: > The "map_sz" is the number of elements in the "m" array so the > > comparison needs to be changed to >= to prevent an out of bounds > read. > > Fixes: 09574cca6ad6 ("hte: Add Tegra194 HTE kernel provider") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- Acked-by: Dipen Patel <dipenp@nvidia.com>
diff --git a/drivers/hte/hte-tegra194.c b/drivers/hte/hte-tegra194.c index 49a27af22742..d1b579c82279 100644 --- a/drivers/hte/hte-tegra194.c +++ b/drivers/hte/hte-tegra194.c @@ -251,7 +251,7 @@ static int tegra_hte_map_to_line_id(u32 eid, { if (m) { - if (eid > map_sz) + if (eid >= map_sz) return -EINVAL; if (m[eid].slice == NV_AON_SLICE_INVALID) return -EINVAL;
The "map_sz" is the number of elements in the "m" array so the > comparison needs to be changed to >= to prevent an out of bounds read. Fixes: 09574cca6ad6 ("hte: Add Tegra194 HTE kernel provider") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- I think map is tegra194_aon_gpio_map and map_sz is ARRAY_SIZE(tegra194_aon_gpio_map) but I wasn't able to follow the code all the way through. Untested. drivers/hte/hte-tegra194.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)