Received: by 2002:a05:6a10:5bc5:0:0:0:0 with SMTP id os5csp2208324pxb; Tue, 12 Oct 2021 01:32:12 -0700 (PDT) X-Google-Smtp-Source: ABdhPJym7wC6qSy1iBvvszc59CIaFI8r47XWGHoouo3kcaNFTKC4GiHxldx7iUl+Db56PjaPiO7H X-Received: by 2002:a63:63c5:: with SMTP id x188mr21527517pgb.391.1634027532245; Tue, 12 Oct 2021 01:32:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1634027532; cv=none; d=google.com; s=arc-20160816; b=vX0FXGtnbHXPeguaW3th3lciBjiDMixCC8ylsW5unLTgMC+VIFSrH7DR2Qj3X2EzIV FQQF7NpJygRcxXQ+hr6XefJR5BNw8V0nZzacAD9J9Yh5buUE5srgqE73vbuwbYksOHmS 2CYQ7QF9PiZlHqcRJLrAQ4vR5YLmt67WtGL7dL4nc70TUwSPyWcQwpysjediOgFAfMKm 9tBscGjswjQNUfttiWfzqe5wgycQMtunNOGWTfpqTZB580PXXSXsmnNPhyBxQTa3IWvG saQrFDiSX0QRnHjaXDahi3orm+Oyzz1w3gcscwwNicOwcgE1YdSLdrV2g0tYnjTRj5rr k6ow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:date:cc:to:from:subject :message-id; bh=iMxhTPSItJcQZasNAu5i6GXIquQQ34znquWjitPUZxM=; b=ygkbMPVmk8+4t/r66L38vDXH6MPl11y1TYolrwojUlF530xQFNEPGulgGMWUvESzWq 1mKbn8F+KiMQsPupMP5IIjXb0Ywu7KwPco692hviuDjeMN3kv49bwk+wh7fnVInrPTjM hJn+DMGitJbmfRBRumBbhftdZCXrt6/KSOymDRI+P0MhKoVOCcg4JW4ttgcuG5vtsWV0 QbYsj/zksQAZjeNlobQB8Aopzt9uicNFAmrM0jIcog9JVrQvl+QBIuxO25zp2YknFQb1 FBH7reH0YRjQH3Gbc8xcJlOMqDtg8kAqel36MAgM7GhcDuyeoNyfIhHeQL3v9+tv027M TyJw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id v10si2496794pju.117.2021.10.12.01.32.00; Tue, 12 Oct 2021 01:32:12 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235060AbhJLIbp (ORCPT + 99 others); Tue, 12 Oct 2021 04:31:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33154 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234998AbhJLIbj (ORCPT ); Tue, 12 Oct 2021 04:31:39 -0400 Received: from metis.ext.pengutronix.de (metis.ext.pengutronix.de [IPv6:2001:67c:670:201:290:27ff:fe1d:cc33]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 799D1C061570 for ; Tue, 12 Oct 2021 01:29:37 -0700 (PDT) Received: from gallifrey.ext.pengutronix.de ([2001:67c:670:201:5054:ff:fe8d:eefb] helo=[IPv6:::1]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1maDAA-0004lW-0v; Tue, 12 Oct 2021 10:29:30 +0200 Message-ID: Subject: Re: [PATCH] soc: imx: imx8m-blk-ctrl: off by one in imx8m_blk_ctrl_xlate() From: Lucas Stach To: Dan Carpenter , Shawn Guo Cc: Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , NXP Linux Team , Peng Fan , Philipp Zabel , Frieder Schrempf , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Date: Tue, 12 Oct 2021 10:29:27 +0200 In-Reply-To: <20211011123638.GB15188@kili> References: <20211011123638.GB15188@kili> Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.40.4 (3.40.4-1.fc34) MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-SA-Exim-Connect-IP: 2001:67c:670:201:5054:ff:fe8d:eefb X-SA-Exim-Mail-From: l.stach@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false X-PTX-Original-Recipient: linux-kernel@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Dan, Am Montag, dem 11.10.2021 um 15:36 +0300 schrieb Dan Carpenter: > The > comparison should be >= to prevent reading one element beyond the > end of the array. The onecell_data->domains[] array is allocated in > imx8m_blk_ctrl_probe() and it has "onecell_data->num_domains" elements. Thanks for the patch! I guess this was found via smatch? I should really make it a habit to use smatch on my submissions... > Fixes: 5b340e7813d4 ("soc: imx: add i.MX8M blk-ctrl driver") > Signed-off-by: Dan Carpenter Reviewed-by: Lucas Stach > --- > drivers/soc/imx/imx8m-blk-ctrl.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/soc/imx/imx8m-blk-ctrl.c b/drivers/soc/imx/imx8m-blk-ctrl.c > index e172d295c441..519b3651d1d9 100644 > --- a/drivers/soc/imx/imx8m-blk-ctrl.c > +++ b/drivers/soc/imx/imx8m-blk-ctrl.c > @@ -139,7 +139,7 @@ imx8m_blk_ctrl_xlate(struct of_phandle_args *args, void *data) > unsigned int index = args->args[0]; > > if (args->args_count != 1 || > - index > onecell_data->num_domains) > + index >= onecell_data->num_domains) > return ERR_PTR(-EINVAL); > > return onecell_data->domains[index];