From: Dan Carpenter <dan.carpenter@oracle.com>
To: mmayer@broadcom.com
Cc: linux-pm@vger.kernel.org
Subject: [bug report] cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs
Date: Fri, 11 Nov 2016 15:52:58 +0300 [thread overview]
Message-ID: <20161111114917.GA3964@mwanda> (raw)
Hello Markus Mayer,
The patch de322e085995: "cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq
driver for Broadcom STB SoCs" from Oct 27, 2016, leads to the
following static checker warning:
drivers/cpufreq/brcmstb-avs-cpufreq.c:509 brcm_avs_get_freq_table()
error: buffer overflow 'table' 5 <= 5
drivers/cpufreq/brcmstb-avs-cpufreq.c
485 static struct cpufreq_frequency_table *
486 brcm_avs_get_freq_table(struct device *dev, struct private_data *priv)
487 {
488 struct cpufreq_frequency_table *table;
489 unsigned int pstate;
490 int i, ret;
491
492 /* Remember P-state for later */
493 ret = brcm_avs_get_pstate(priv, &pstate);
494 if (ret)
495 return ERR_PTR(ret);
496
497 table = devm_kzalloc(dev, (AVS_PSTATE_MAX + 1) * sizeof(*table),
498 GFP_KERNEL);
499 if (!table)
500 return ERR_PTR(-ENOMEM);
501
502 for (i = AVS_PSTATE_P0; i <= AVS_PSTATE_MAX; i++) {
I guess this should be < instead of <=.
503 ret = brcm_avs_set_pstate(priv, i);
504 if (ret)
505 return ERR_PTR(ret);
506 table[i].frequency = brcm_avs_get_frequency(priv->base);
507 table[i].driver_data = i;
508 }
509 table[i].frequency = CPUFREQ_TABLE_END;
Otherwise we're always writing one element beyond the end of the array
here.
510
511 /* Restore P-state */
512 ret = brcm_avs_set_pstate(priv, pstate);
513 if (ret)
514 return ERR_PTR(ret);
515
516 return table;
517 }
regards,
dan carpenter
reply other threads:[~2016-11-11 12:53 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161111114917.GA3964@mwanda \
--to=dan.carpenter@oracle.com \
--cc=linux-pm@vger.kernel.org \
--cc=mmayer@broadcom.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).