* [PATCH] opp: core: Fix off by one in dev_pm_opp_get_bw()
@ 2024-11-30 10:07 Dan Carpenter
2024-12-02 6:32 ` Viresh Kumar
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2024-11-30 10:07 UTC (permalink / raw)
To: Neil Armstrong
Cc: Viresh Kumar, Nishanth Menon, Stephen Boyd, linux-pm,
linux-kernel, kernel-janitors
The "opp->bandwidth" array has "opp->opp_table->path_count" number of
elements. It's allocated in _opp_allocate(). So this > needs to be >=
to prevent an out of bounds access.
Fixes: d78653dcd8bf ("opp: core: implement dev_pm_opp_get_bw")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/opp/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index d4a0030a0228..09a1432561f6 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -121,7 +121,7 @@ unsigned long dev_pm_opp_get_bw(struct dev_pm_opp *opp, bool peak, int index)
return 0;
}
- if (index > opp->opp_table->path_count)
+ if (index >= opp->opp_table->path_count)
return 0;
if (!opp->bandwidth)
--
2.45.2
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] opp: core: Fix off by one in dev_pm_opp_get_bw()
2024-11-30 10:07 [PATCH] opp: core: Fix off by one in dev_pm_opp_get_bw() Dan Carpenter
@ 2024-12-02 6:32 ` Viresh Kumar
0 siblings, 0 replies; 2+ messages in thread
From: Viresh Kumar @ 2024-12-02 6:32 UTC (permalink / raw)
To: Dan Carpenter
Cc: Neil Armstrong, Viresh Kumar, Nishanth Menon, Stephen Boyd,
linux-pm, linux-kernel, kernel-janitors
On 30-11-24, 13:07, Dan Carpenter wrote:
> The "opp->bandwidth" array has "opp->opp_table->path_count" number of
> elements. It's allocated in _opp_allocate(). So this > needs to be >=
> to prevent an out of bounds access.
>
> Fixes: d78653dcd8bf ("opp: core: implement dev_pm_opp_get_bw")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> drivers/opp/core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/opp/core.c b/drivers/opp/core.c
> index d4a0030a0228..09a1432561f6 100644
> --- a/drivers/opp/core.c
> +++ b/drivers/opp/core.c
> @@ -121,7 +121,7 @@ unsigned long dev_pm_opp_get_bw(struct dev_pm_opp *opp, bool peak, int index)
> return 0;
> }
>
> - if (index > opp->opp_table->path_count)
> + if (index >= opp->opp_table->path_count)
> return 0;
>
> if (!opp->bandwidth)
Applied. Thanks.
--
viresh
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-12-02 6:32 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-11-30 10:07 [PATCH] opp: core: Fix off by one in dev_pm_opp_get_bw() Dan Carpenter
2024-12-02 6:32 ` Viresh Kumar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox