From patchwork Sun Jun 28 09:55:32 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Thompson X-Patchwork-Id: 50400 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-la0-f72.google.com (mail-la0-f72.google.com [209.85.215.72]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 9EAE9228D9 for ; Sun, 28 Jun 2015 09:56:08 +0000 (UTC) Received: by lagx9 with SMTP id x9sf11330462lag.2 for ; Sun, 28 Jun 2015 02:56:06 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:cc:subject :date:message-id:x-original-sender:x-original-authentication-results :precedence:mailing-list:list-id:list-post:list-help:list-archive :list-unsubscribe; bh=FozoMySmSGYB76tCoKV6ULmJ+EWFpNrAFpPECGsGPKc=; b=Os9r9Ey+IQlT9Kqk6DpIrAk5iujyxDToNr+VJAZl6QfN6dERcZNcZTmQJqFJIU25en UM6wZi1N0pVoE116wSZJTHIVZLOh1rGHbGebSso37PU+n++iHGg7Y9XiUe2/sD410iZC xnlvjisynJLLhq4cUdWlIV2VhfebXLaIGFe7ECT+J8VTN4gPqn4PV2DEkS1rA+nYqp15 NEUkjjqm7stPu6eFdr1s9xzoiKhMlry1Oc+XWRDOND3I1udM6WNvTh0fL/Tl3g1u5sGu /0bvKYRtCupoSmWT32WMVda0SI+cIxdSKNDP5rPQsW5w1Nmk5Li/c5OpXKLxcA4VgWUh Qyig== X-Gm-Message-State: ALoCoQlm/vjBaqotodpF9Q5WzHYY96pwzAo6F1mvkfK8zOE1vJFg48F0wTH1S+bqImklP3xIfFSJ X-Received: by 10.152.2.196 with SMTP id 4mr7322348law.10.1435485366760; Sun, 28 Jun 2015 02:56:06 -0700 (PDT) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.152.37.8 with SMTP id u8ls698961laj.39.gmail; Sun, 28 Jun 2015 02:56:06 -0700 (PDT) X-Received: by 10.152.1.4 with SMTP id 4mr9287337lai.25.1435485366496; Sun, 28 Jun 2015 02:56:06 -0700 (PDT) Received: from mail-la0-f47.google.com (mail-la0-f47.google.com. [209.85.215.47]) by mx.google.com with ESMTPS id cr7si32129111lad.33.2015.06.28.02.56.05 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 28 Jun 2015 02:56:05 -0700 (PDT) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.215.47 as permitted sender) client-ip=209.85.215.47; Received: by lagh6 with SMTP id h6so24455869lag.2 for ; Sun, 28 Jun 2015 02:56:05 -0700 (PDT) X-Received: by 10.112.199.133 with SMTP id jk5mr9483484lbc.32.1435485365718; Sun, 28 Jun 2015 02:56:05 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patches@linaro.org Received: by 10.112.108.230 with SMTP id hn6csp1004093lbb; Sun, 28 Jun 2015 02:56:05 -0700 (PDT) X-Received: by 10.194.48.108 with SMTP id k12mr13652355wjn.151.1435485365012; Sun, 28 Jun 2015 02:56:05 -0700 (PDT) Received: from mail-wg0-f45.google.com (mail-wg0-f45.google.com. [74.125.82.45]) by mx.google.com with ESMTPS id ej6si7427983wid.100.2015.06.28.02.56.04 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 28 Jun 2015 02:56:04 -0700 (PDT) Received-SPF: pass (google.com: domain of daniel.thompson@linaro.org designates 74.125.82.45 as permitted sender) client-ip=74.125.82.45; Received: by wgjx7 with SMTP id x7so45782448wgj.2 for ; Sun, 28 Jun 2015 02:56:04 -0700 (PDT) X-Received: by 10.180.85.8 with SMTP id d8mr12300947wiz.11.1435485364735; Sun, 28 Jun 2015 02:56:04 -0700 (PDT) Received: from scallop.lan (cpc4-aztw19-0-0-cust71.18-1.cable.virginm.net. [82.33.25.72]) by mx.google.com with ESMTPSA id u6sm58647104wja.40.2015.06.28.02.56.03 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 28 Jun 2015 02:56:03 -0700 (PDT) From: Daniel Thompson To: Mike Turquette , Stephen Boyd Cc: Daniel Thompson , Maxime Coquelin , linux-clk@vger.kernel.org, linux-kernel@vger.kernel.org, patches@linaro.org, linaro-kernel@lists.linaro.org Subject: [PATCH] clk: stm32: Fix out-by-one error path in the index lookup Date: Sun, 28 Jun 2015 10:55:32 +0100 Message-Id: <1435485332-14951-1-git-send-email-daniel.thompson@linaro.org> X-Mailer: git-send-email 2.4.3 X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: daniel.thompson@linaro.org X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.215.47 as permitted sender) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Precedence: list Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org List-ID: X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , If stm32f4_rcc_lookup() is called with primary == 0 and secondary == 192 then it will read beyond the end of the table array due to an out-by-one error in the range check. In addition to the fixing the inequality we also modify the r.h.s. to make it even more explicit that we are comparing against the size of table in bits. Reported-by: Dan Carpenter Signed-off-by: Daniel Thompson --- drivers/clk/clk-stm32f4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.4.3 diff --git a/drivers/clk/clk-stm32f4.c b/drivers/clk/clk-stm32f4.c index c825bbd..148c151 100644 --- a/drivers/clk/clk-stm32f4.c +++ b/drivers/clk/clk-stm32f4.c @@ -268,7 +268,7 @@ static int stm32f4_rcc_lookup_clk_idx(u8 primary, u8 secondary) memcpy(table, stm32f42xx_gate_map, sizeof(table)); /* only bits set in table can be used as indices */ - if (WARN_ON(secondary > 8 * sizeof(table) || + if (WARN_ON(secondary >= BITS_PER_BYTE * sizeof(table) || 0 == (table[BIT_ULL_WORD(secondary)] & BIT_ULL_MASK(secondary)))) return -EINVAL;