lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 12 Oct 2021 10:29:27 +0200 From: Lucas Stach <l.stach@...gutronix.de> To: Dan Carpenter <dan.carpenter@...cle.com>, Shawn Guo <shawnguo@...nel.org> Cc: Sascha Hauer <s.hauer@...gutronix.de>, Pengutronix Kernel Team <kernel@...gutronix.de>, Fabio Estevam <festevam@...il.com>, NXP Linux Team <linux-imx@....com>, Peng Fan <peng.fan@....com>, Philipp Zabel <p.zabel@...gutronix.de>, Frieder Schrempf <frieder.schrempf@...tron.de>, linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org Subject: Re: [PATCH] soc: imx: imx8m-blk-ctrl: off by one in imx8m_blk_ctrl_xlate() Hi Dan, Am Montag, dem 11.10.2021 um 15:36 +0300 schrieb Dan Carpenter: > The > comparison should be >= to prevent reading one element beyond the > end of the array. The onecell_data->domains[] array is allocated in > imx8m_blk_ctrl_probe() and it has "onecell_data->num_domains" elements. Thanks for the patch! I guess this was found via smatch? I should really make it a habit to use smatch on my submissions... > Fixes: 5b340e7813d4 ("soc: imx: add i.MX8M blk-ctrl driver") > Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com> Reviewed-by: Lucas Stach <l.stach@...gutronix.de> > --- > drivers/soc/imx/imx8m-blk-ctrl.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/soc/imx/imx8m-blk-ctrl.c b/drivers/soc/imx/imx8m-blk-ctrl.c > index e172d295c441..519b3651d1d9 100644 > --- a/drivers/soc/imx/imx8m-blk-ctrl.c > +++ b/drivers/soc/imx/imx8m-blk-ctrl.c > @@ -139,7 +139,7 @@ imx8m_blk_ctrl_xlate(struct of_phandle_args *args, void *data) > unsigned int index = args->args[0]; > > if (args->args_count != 1 || > - index > onecell_data->num_domains) > + index >= onecell_data->num_domains) > return ERR_PTR(-EINVAL); > > return onecell_data->domains[index];
Powered by blists - more mailing lists