From patchwork Wed Apr 29 13:23:23 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 1279331 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=linux-i2c-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=oracle.com header.i=@oracle.com header.a=rsa-sha256 header.s=corp-2020-01-29 header.b=UCjcj1f4; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49Bzjr4ymXz9sSM for ; Wed, 29 Apr 2020 23:23:44 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726558AbgD2NXl (ORCPT ); Wed, 29 Apr 2020 09:23:41 -0400 Received: from userp2120.oracle.com ([156.151.31.85]:44054 "EHLO userp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726654AbgD2NXk (ORCPT ); Wed, 29 Apr 2020 09:23:40 -0400 Received: from pps.filterd (userp2120.oracle.com [127.0.0.1]) by userp2120.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 03TDNJ3g138357; Wed, 29 Apr 2020 13:23:33 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=date : from : to : cc : subject : message-id : mime-version : content-type; s=corp-2020-01-29; bh=tNRNdLBshIc6ibNJ1XgsnMCjX7602JFV2oQLAaX80FU=; b=UCjcj1f4tVDHwIl2/HZuQdGfQJkzSr0qjcFu84YMu/B7cs7lGDh251m/8naRxdrb8Rnu 0ZUNVzSPPodkfpUKY8Atzw6QCH6IhNRF8VbZJBkG4BUxk2NVuuiXtWCf4/MeVy9T3jSi GzV+Q3p9wXYLsbb0PDJPFgV+6fyawMIfikQWN7UFkf4WOA3hFnsMh96XVePJ1Qe81n0x pK9Ox4xg62dzLazilzNZxemRJNg6Fg2cEeFuhm/lfuPDeG5lV3Dwrlu/LNJyLJYNjQcY fJmVlFii2x8YQlZED4piGSMFI+tY+Ola6MPYviu0Oz6PM6wNLi19gfjinRvj/4At3l9/ 9w== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by userp2120.oracle.com with ESMTP id 30p2p0b3ht-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 29 Apr 2020 13:23:33 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 03TDN4Ej026942; Wed, 29 Apr 2020 13:23:32 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserp3020.oracle.com with ESMTP id 30my0gwqja-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 29 Apr 2020 13:23:32 +0000 Received: from abhmp0013.oracle.com (abhmp0013.oracle.com [141.146.116.19]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id 03TDNUAU031565; Wed, 29 Apr 2020 13:23:31 GMT Received: from mwanda (/41.57.98.10) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 29 Apr 2020 06:23:30 -0700 Date: Wed, 29 Apr 2020 16:23:23 +0300 From: Dan Carpenter To: Pierre-Yves MORDRET , Alain Volmat Cc: Maxime Coquelin , Alexandre Torgue , linux-i2c@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, kernel-janitors@vger.kernel.org Subject: [PATCH] i2c: stm32f7: prevent array underflow in stm32f7_get_lower_rate() Message-ID: <20200429132323.GB815283@mwanda> MIME-Version: 1.0 Content-Disposition: inline X-Mailer: git-send-email haha only kidding X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9605 signatures=668686 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 spamscore=0 suspectscore=0 adultscore=0 mlxlogscore=787 bulkscore=0 phishscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004290113 X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9605 signatures=668686 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 clxscore=1011 bulkscore=0 adultscore=0 lowpriorityscore=0 impostorscore=0 malwarescore=0 mlxscore=0 suspectscore=0 mlxlogscore=836 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004290113 Sender: linux-i2c-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-i2c@vger.kernel.org We want to break with "i" set to zero whether we find the rate we want or not. In the current code, if we don't find the rate we want then it exits the loop with "i" set to -1 and results in an array underflow. Fixes: 09cc9a3bce91 ("i2c: stm32f7: allows for any bus frequency") Signed-off-by: Dan Carpenter Reviewed-by: Alain Volmat --- drivers/i2c/busses/i2c-stm32f7.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c index 9c9e10ea91991..bff3479fe122a 100644 --- a/drivers/i2c/busses/i2c-stm32f7.c +++ b/drivers/i2c/busses/i2c-stm32f7.c @@ -607,7 +607,7 @@ static u32 stm32f7_get_lower_rate(u32 rate) { int i = ARRAY_SIZE(stm32f7_i2c_specs); - while (i--) + while (--i) if (stm32f7_i2c_specs[i].rate < rate) break;