aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDaniel Thompson <daniel.thompson@linaro.org>2015-06-28 05:55:32 -0400
committerStephen Boyd <sboyd@codeaurora.org>2015-07-02 12:51:26 -0400
commit15ab38273d21a45487116ad4c428593427954848 (patch)
tree2a96fa167916c61250de1400736a7e3523f7226b
parent69916d96094e1e16567c5f25515a13ed2896c730 (diff)
clk: stm32: Fix out-by-one error path in the index lookup
If stm32f4_rcc_lookup() is called with primary == 0 and secondary == 192 then it will read beyond the end of the table array due to an out-by-one error in the range check. In addition to the fixing the inequality we also modify the r.h.s. to make it even more explicit that we are comparing against the size of table in bits. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org> Acked-by: Maxime Coquelin <mcoquelin.stm32@gmail.com> Fixes: 358bdf892f6b ("clk: stm32: Add clock driver for STM32F4[23]xxx devices") Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
-rw-r--r--drivers/clk/clk-stm32f4.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/clk/clk-stm32f4.c b/drivers/clk/clk-stm32f4.c
index b9b12a742970..3f6f7ad39490 100644
--- a/drivers/clk/clk-stm32f4.c
+++ b/drivers/clk/clk-stm32f4.c
@@ -268,7 +268,7 @@ static int stm32f4_rcc_lookup_clk_idx(u8 primary, u8 secondary)
268 memcpy(table, stm32f42xx_gate_map, sizeof(table)); 268 memcpy(table, stm32f42xx_gate_map, sizeof(table));
269 269
270 /* only bits set in table can be used as indices */ 270 /* only bits set in table can be used as indices */
271 if (WARN_ON(secondary > 8 * sizeof(table) || 271 if (WARN_ON(secondary >= BITS_PER_BYTE * sizeof(table) ||
272 0 == (table[BIT_ULL_WORD(secondary)] & 272 0 == (table[BIT_ULL_WORD(secondary)] &
273 BIT_ULL_MASK(secondary)))) 273 BIT_ULL_MASK(secondary))))
274 return -EINVAL; 274 return -EINVAL;