Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2019-02-15 10:23:48 +0100
committerJiri Slaby <jslaby@suse.cz>2019-02-15 10:23:58 +0100
commitc239577a3b71beb475fd1b0d35b238ab5e2c6ccd (patch)
tree11157d7f6659cb19f3a7f4157bc3610bd238d6e9
parentf97e1227aad47c0e4f67d7f35be6ec698e1f209a (diff)
misc: vexpress: Off by one in vexpress_syscfg_exec()
-rw-r--r--patches.kernel.org/4.20.9-013-misc-vexpress-Off-by-one-in-vexpress_syscfg_ex.patch40
-rw-r--r--series.conf1
2 files changed, 41 insertions, 0 deletions
diff --git a/patches.kernel.org/4.20.9-013-misc-vexpress-Off-by-one-in-vexpress_syscfg_ex.patch b/patches.kernel.org/4.20.9-013-misc-vexpress-Off-by-one-in-vexpress_syscfg_ex.patch
new file mode 100644
index 0000000000..18cf59eea9
--- /dev/null
+++ b/patches.kernel.org/4.20.9-013-misc-vexpress-Off-by-one-in-vexpress_syscfg_ex.patch
@@ -0,0 +1,40 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 3 Dec 2018 17:52:19 +0300
+Subject: [PATCH] misc: vexpress: Off by one in vexpress_syscfg_exec()
+References: bnc#1012628
+Patch-mainline: 4.20.9
+Git-commit: f8a70d8b889f180e6860cb1f85fed43d37844c5a
+
+commit f8a70d8b889f180e6860cb1f85fed43d37844c5a upstream.
+
+The > comparison should be >= to prevent reading beyond the end of the
+func->template[] array.
+
+(The func->template array is allocated in vexpress_syscfg_regmap_init()
+and it has func->num_templates elements.)
+
+Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/misc/vexpress-syscfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/vexpress-syscfg.c b/drivers/misc/vexpress-syscfg.c
+index 6c3591cdf855..a3c6c773d9dc 100644
+--- a/drivers/misc/vexpress-syscfg.c
++++ b/drivers/misc/vexpress-syscfg.c
+@@ -61,7 +61,7 @@ static int vexpress_syscfg_exec(struct vexpress_syscfg_func *func,
+ int tries;
+ long timeout;
+
+- if (WARN_ON(index > func->num_templates))
++ if (WARN_ON(index >= func->num_templates))
+ return -EINVAL;
+
+ command = readl(syscfg->base + SYS_CFGCTRL);
+--
+2.20.1
+
diff --git a/series.conf b/series.conf
index a953cad21d..19abd6b699 100644
--- a/series.conf
+++ b/series.conf
@@ -1095,6 +1095,7 @@
patches.kernel.org/4.20.9-010-signal-Always-attempt-to-allocate-siginfo-for-.patch
patches.kernel.org/4.20.9-011-signal-Always-notice-exiting-tasks.patch
patches.kernel.org/4.20.9-012-signal-Better-detection-of-synchronous-signals.patch
+ patches.kernel.org/4.20.9-013-misc-vexpress-Off-by-one-in-vexpress_syscfg_ex.patch
########################################################
# Build fixes that apply to the vanilla kernel too.