mmc: dw_mmc-k3: Fix out-of-bounds access through DT alias
authorGeert Uytterhoeven <geert+renesas@glider.be>
Fri, 23 Feb 2018 12:44:19 +0000 (13:44 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 9 Mar 2018 06:41:03 +0000 (22:41 -0800)
commitcb65fc21f3877599e1c22710c5fdbefd0be010d4
tree657cb5e0875c6aa963d11cf593cb841d5b73a722
parent33b42aa617d16436ddbde6d192c6a6c2db566648
mmc: dw_mmc-k3: Fix out-of-bounds access through DT alias

commit 325501d9360eb42c7c51e6daa0d733844c1e790b upstream.

The hs_timing_cfg[] array is indexed using a value derived from the
"mshcN" alias in DT, which may lead to an out-of-bounds access.

Fix this by adding a range check.

Fixes: 361c7fe9b02eee7e ("mmc: dw_mmc-k3: add sd support for hi3660")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/mmc/host/dw_mmc-k3.c