pinctrl: rza1: off by one in rza1_parse_gpiochip()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 18 Aug 2017 10:32:48 +0000 (13:32 +0300)
committerLinus Walleij <linus.walleij@linaro.org>
Thu, 31 Aug 2017 11:37:16 +0000 (13:37 +0200)
The rza1_pctl->ports[] array has RZA1_NPORTS (12) elements.  The > here
should be >= to prevent an out of bounds access.

Fixes: 5a49b644b307 ("pinctrl: Renesas RZ/A1 pin and gpio controller")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: Jacopo Mondi <jacopo@jmondi.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
drivers/pinctrl/pinctrl-rza1.c

index f75d6995c68494fadd72fbe71583df87e51dac60..7fe5b373f58cd90218d874cd1615ae6726626406 100644 (file)
@@ -1088,7 +1088,7 @@ static int rza1_parse_gpiochip(struct rza1_pinctrl *rza1_pctl,
         */
        pinctrl_base = of_args.args[1];
        gpioport = RZA1_PIN_ID_TO_PORT(pinctrl_base);
-       if (gpioport > RZA1_NPORTS) {
+       if (gpioport >= RZA1_NPORTS) {
                dev_err(rza1_pctl->dev,
                        "Invalid values in property %s\n", list_name);
                return -EINVAL;