2020-08-25 10:50:44

by Dan Carpenter

Subject: [PATCH] memory: omap-gpmc: Fix a couple off by ones

These comparisons should be >= instead of > to prevent reading one
element beyond the end of the gpmc_cs[] array.

Fixes: cdd6928c589a ("ARM: OMAP2+: Add device-tree support for NOR flash")
Fixes: f37e4580c409 ("ARM: OMAP2: Dynamic allocator for GPMC memory space")
Signed-off-by: Dan Carpenter <[email protected]>
---
drivers/memory/omap-gpmc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index cd9e80748591..fd245b82163a 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -989,7 +989,7 @@ static int gpmc_cs_remap(int cs, u32 base)
int ret;
u32 old_base, size;

- if (cs > gpmc_cs_num) {
+ if (cs >= gpmc_cs_num) {
pr_err("%s: requested chip-select is disabled\n", __func__);
return -ENODEV;
}
@@ -1024,7 +1024,7 @@ int gpmc_cs_request(int cs, unsigned long size, unsigned long *base)
struct resource *res = &gpmc->mem;
int r = -1;

- if (cs > gpmc_cs_num) {
+ if (cs >= gpmc_cs_num) {
pr_err("%s: requested chip-select is disabled\n", __func__);
return -ENODEV;
}
--
2.28.0

2020-08-26 13:09:40

by Roger Quadros

Subject: Re: [PATCH] memory: omap-gpmc: Fix a couple off by ones

On 25/08/2020 13:47, Dan Carpenter wrote:
> These comparisons should be >= instead of > to prevent reading one
> element beyond the end of the gpmc_cs[] array.
>
> Fixes: cdd6928c589a ("ARM: OMAP2+: Add device-tree support for NOR flash")
> Fixes: f37e4580c409 ("ARM: OMAP2: Dynamic allocator for GPMC memory space")
> Signed-off-by: Dan Carpenter <[email protected]>

Acked-by: Roger Quadros <[email protected]>

> ---
> drivers/memory/omap-gpmc.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
> index cd9e80748591..fd245b82163a 100644
> --- a/drivers/memory/omap-gpmc.c
> +++ b/drivers/memory/omap-gpmc.c
> @@ -989,7 +989,7 @@ static int gpmc_cs_remap(int cs, u32 base)
> int ret;
> u32 old_base, size;
>
> - if (cs > gpmc_cs_num) {
> + if (cs >= gpmc_cs_num) {
> pr_err("%s: requested chip-select is disabled\n", __func__);
> return -ENODEV;
> }
> @@ -1024,7 +1024,7 @@ int gpmc_cs_request(int cs, unsigned long size, unsigned long *base)
> struct resource *res = &gpmc->mem;
> int r = -1;
>
> - if (cs > gpmc_cs_num) {
> + if (cs >= gpmc_cs_num) {
> pr_err("%s: requested chip-select is disabled\n", __func__);
> return -ENODEV;
> }
>

cheers,
-roger

--
Texas Instruments Finland Oy, Porkkalankatu 22, 00180 Helsinki.
Y-tunnus/Business ID: 0615521-4. Kotipaikka/Domicile: Helsinki

2020-08-26 18:25:41

by Krzysztof Kozlowski

Subject: Re: [PATCH] memory: omap-gpmc: Fix a couple off by ones

On Tue, Aug 25, 2020 at 01:47:07PM +0300, Dan Carpenter wrote:
> These comparisons should be >= instead of > to prevent reading one
> element beyond the end of the gpmc_cs[] array.
>
> Fixes: cdd6928c589a ("ARM: OMAP2+: Add device-tree support for NOR flash")
> Fixes: f37e4580c409 ("ARM: OMAP2: Dynamic allocator for GPMC memory space")
> Signed-off-by: Dan Carpenter <[email protected]>
> ---
> drivers/memory/omap-gpmc.c | 4 ++--

Thanks, applied.

Best regards,
Krzysztof