clk: stm32: Fix out-by-one error path in the index lookup
authorDaniel Thompson <daniel.thompson@linaro.org>
Sun, 28 Jun 2015 09:55:32 +0000 (10:55 +0100)
committerStephen Boyd <sboyd@codeaurora.org>
Thu, 2 Jul 2015 16:51:26 +0000 (09:51 -0700)
If stm32f4_rcc_lookup() is called with primary == 0 and secondary == 192
then it will read beyond the end of the table array due to an out-by-one
error in the range check.

In addition to the fixing the inequality we also modify the r.h.s. to
make it even more explicit that we are comparing against the size of
table in bits.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Acked-by: Maxime Coquelin <mcoquelin.stm32@gmail.com>
Fixes: 358bdf892f6b ("clk: stm32: Add clock driver for STM32F4[23]xxx devices")
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
drivers/clk/clk-stm32f4.c

index b9b12a742970d5e195f048e571bd5cf7936694e6..3f6f7ad39490458a6e9cdcf4d944665abd34df86 100644 (file)
@@ -268,7 +268,7 @@ static int stm32f4_rcc_lookup_clk_idx(u8 primary, u8 secondary)
        memcpy(table, stm32f42xx_gate_map, sizeof(table));
 
        /* only bits set in table can be used as indices */
-       if (WARN_ON(secondary > 8 * sizeof(table) ||
+       if (WARN_ON(secondary >= BITS_PER_BYTE * sizeof(table) ||
                    0 == (table[BIT_ULL_WORD(secondary)] &
                          BIT_ULL_MASK(secondary))))
                return -EINVAL;