Sender: Guenter Roeck <groeck7@gmail.com>
Subject: Re: [PATCH] watchdog: fix array may be out of bound
To:     zhangyue <zhangyue1@kylinos.cn>, wim@linux-watchdog.org
Cc:     linux-watchdog@vger.kernel.org, linux-kernel@vger.kernel.org
References: <20211213033419.70458-1-zhangyue1@kylinos.cn>
From:   Guenter Roeck <linux@roeck-us.net>
Message-ID: <8cef5d56-0d26-d35c-13c4-f6a6671888a2@roeck-us.net>
Date:   Sun, 12 Dec 2021 20:03:33 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.14.0
MIME-Version: 1.0
In-Reply-To: <20211213033419.70458-1-zhangyue1@kylinos.cn>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 12/12/21 7:34 PM, zhangyue wrote:
> In this function, the param 'idx' may be
> equal to 'DW_WDT_NUM_TOPS'.
> At this time, the array 'dw_wdt->timeouts'
> may be out of bound
> 
> Signed-off-by: zhangyue <zhangyue1@kylinos.cn>
> ---
>   drivers/watchdog/dw_wdt.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/watchdog/dw_wdt.c b/drivers/watchdog/dw_wdt.c
> index cd578843277e..15fb1895c085 100644
> --- a/drivers/watchdog/dw_wdt.c
> +++ b/drivers/watchdog/dw_wdt.c
> @@ -155,6 +155,9 @@ static unsigned int dw_wdt_get_min_timeout(struct dw_wdt *dw_wdt)
>   			break;
>   	}
>   
> +	if (idx == DW_WDT_NUM_TOPS)
> +		return 1;
> +

Please look at the code (and the comments) more closely.
This can not happen.

Guenter