tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

phy: stm32-usphyc: Fix off by one in probe()

The "index" variable is used as an index into the usbphyc->phys[] array
which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys
then it is one element out of bounds. The "index" comes from the
device tree so it's data that we trust and it's unlikely to be wrong,
however it's obviously still worth fixing the bug. Change the > to >=.

Fixes: 94c358da3a05 ("phy: stm32: add support for STM32 USB PHY Controller (USBPHYC)")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Link: https://patch.msgid.link/aTfHcMJK1wFVnvEe@stanley.mountain
Signed-off-by: Vinod Koul <vkoul@kernel.org>

authored by

Dan Carpenter and committed by
Vinod Koul cabd25b5 1ca52c09

+1 -1
+1 -1
drivers/phy/st/phy-stm32-usbphyc.c
··· 712 712 } 713 713 714 714 ret = of_property_read_u32(child, "reg", &index); 715 - if (ret || index > usbphyc->nphys) { 715 + if (ret || index >= usbphyc->nphys) { 716 716 dev_err(&phy->dev, "invalid reg property: %d\n", ret); 717 717 if (!ret) 718 718 ret = -EINVAL;