diff options
| author | Srinivas Kandagatla <srinivas.kandagatla@linaro.org> | 2022-08-15 17:35:28 +0530 |
|---|---|---|
| committer | Amit Pundir <amit.pundir@linaro.org> | 2022-08-15 17:36:45 +0530 |
| commit | 54053c7ceebc99405a1e4aad42d48484c93f439e (patch) | |
| tree | 88e3304a593bf7a6724e639cfb864ff9f502dac7 | |
| parent | 968fa950e55832813476ee7f8fe8982b8b5ded7e (diff) | |
FROMLIST: soundwire: qcom: fix device status array rangewip/rbX-mainline
https://www.spinics.net/lists/linux-arm-msm/msg117502.html
This patch updates device status array range from 11 to 12 as we will
be reading status from device number 0 to device number 11 inclusive.
Without this patch we can potentially access status array out of range
during auto-enumeration.
Fixes: aa1262ca6695 ("soundwire: qcom: Check device status before reading devid")
Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@xxxxxxxxxx>
| -rw-r--r-- | drivers/soundwire/qcom.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c index a43961ad4614..3a992a6478c3 100644 --- a/drivers/soundwire/qcom.c +++ b/drivers/soundwire/qcom.c @@ -169,7 +169,7 @@ struct qcom_swrm_ctrl { u8 wcmd_id; struct qcom_swrm_port_config pconfig[QCOM_SDW_MAX_PORTS]; struct sdw_stream_runtime *sruntime[SWRM_MAX_DAIS]; - enum sdw_slave_status status[SDW_MAX_DEVICES]; + enum sdw_slave_status status[SDW_MAX_DEVICES + 1]; int (*reg_read)(struct qcom_swrm_ctrl *ctrl, int reg, u32 *val); int (*reg_write)(struct qcom_swrm_ctrl *ctrl, int reg, int val); u32 slave_status; @@ -420,7 +420,7 @@ static int qcom_swrm_get_alert_slave_dev_num(struct qcom_swrm_ctrl *ctrl) ctrl->reg_read(ctrl, SWRM_MCP_SLV_STATUS, &val); - for (dev_num = 0; dev_num < SDW_MAX_DEVICES; dev_num++) { + for (dev_num = 0; dev_num <= SDW_MAX_DEVICES; dev_num++) { status = (val >> (dev_num * SWRM_MCP_SLV_STATUS_SZ)); if ((status & SWRM_MCP_SLV_STATUS_MASK) == SDW_SLAVE_ALERT) { @@ -440,7 +440,7 @@ static void qcom_swrm_get_device_status(struct qcom_swrm_ctrl *ctrl) ctrl->reg_read(ctrl, SWRM_MCP_SLV_STATUS, &val); ctrl->slave_status = val; - for (i = 0; i < SDW_MAX_DEVICES; i++) { + for (i = 0; i <= SDW_MAX_DEVICES; i++) { u32 s; s = (val >> (i * 2)); |