MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2026-01-27 12:35:36 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

pinctrl: stm32: fix array read out of bound

Browse Source 
[ Upstream commit edd48fd9d4 ]

The existing code does not verify if the "tentative" index exceeds
the size of the array, causing out of bound read.
Issue identified with kasan.

Check the index before using it.

Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
Fixes: 32c170ff15 ("pinctrl: stm32: set default gpio line names using pin names")
Link: https://lore.kernel.org/r/20231107110520.4449-1-antonio.borneo@foss.st.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Antonio Borneo 2023-11-07 12:05:20 +01:00 committed by Greg Kroah-Hartman
parent 3e3fa8056f
commit a9659016f9
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/pinctrl/stm32/pinctrl-stm32.c
View File

@ -1283,9 +1283,11 @@ static struct stm32_desc_pin *stm32_pctrl_get_desc_pin_from_gpio(struct stm32_pi
int i;
/* With few exceptions (e.g. bank 'Z'), pin number matches with pin index in array */
pin_desc = pctl->pins + stm32_pin_nb;
if (pin_desc->pin.number == stm32_pin_nb)
return pin_desc;
if (stm32_pin_nb < pctl->npins) {
pin_desc = pctl->pins + stm32_pin_nb;
if (pin_desc->pin.number == stm32_pin_nb)
return pin_desc;
}
/* Otherwise, loop all array to find the pin with the right number */
for (i = 0; i < pctl->npins; i++) {