diff mbox

remoteproc: imx_rproc: fix a couple off by one bugs

Message ID 20171005125827.sfnrpmqhrgmpy3fp@mwanda (mailing list archive)
State Accepted
Headers show

Commit Message

Dan Carpenter Oct. 5, 2017, 12:58 p.m. UTC
The priv->mem[] array has IMX7D_RPROC_MEM_MAX elements so the > should
be >= to avoid writing one element beyond the end of the array.

Fixes: a0ff4aa6f010 ("remoteproc: imx_rproc: add a NXP/Freescale imx_rproc driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-remoteproc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Oleksij Rempel Oct. 9, 2017, 5:14 a.m. UTC | #1
Hi Dan,

On 05.10.2017 14:58, Dan Carpenter wrote:
> The priv->mem[] array has IMX7D_RPROC_MEM_MAX elements so the > should
> be >= to avoid writing one element beyond the end of the array.
> 
> Fixes: a0ff4aa6f010 ("remoteproc: imx_rproc: add a NXP/Freescale imx_rproc driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c
> index 612d91403341..81ba44510b75 100644
> --- a/drivers/remoteproc/imx_rproc.c
> +++ b/drivers/remoteproc/imx_rproc.c
> @@ -264,7 +264,7 @@ static int imx_rproc_addr_init(struct imx_rproc *priv,
>   		if (!(att->flags & ATT_OWN))
>   			continue;
>   
> -		if (b > IMX7D_RPROC_MEM_MAX)
> +		if (b >= IMX7D_RPROC_MEM_MAX)
>   			break;


ahrr... you are right!
thx.
--
To unsubscribe from this list: send the line "unsubscribe linux-remoteproc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c
index 612d91403341..81ba44510b75 100644
--- a/drivers/remoteproc/imx_rproc.c
+++ b/drivers/remoteproc/imx_rproc.c
@@ -264,7 +264,7 @@  static int imx_rproc_addr_init(struct imx_rproc *priv,
 		if (!(att->flags & ATT_OWN))
 			continue;
 
-		if (b > IMX7D_RPROC_MEM_MAX)
+		if (b >= IMX7D_RPROC_MEM_MAX)
 			break;
 
 		priv->mem[b].cpu_addr = devm_ioremap(&pdev->dev,
@@ -296,7 +296,7 @@  static int imx_rproc_addr_init(struct imx_rproc *priv,
 			return err;
 		}
 
-		if (b > IMX7D_RPROC_MEM_MAX)
+		if (b >= IMX7D_RPROC_MEM_MAX)
 			break;
 
 		priv->mem[b].cpu_addr = devm_ioremap_resource(&pdev->dev, &res);