diff options
| author | Antonio Borneo <[email protected]> | 2023-11-07 12:05:20 +0100 |
|---|---|---|
| committer | Linus Walleij <[email protected]> | 2023-11-14 14:41:48 +0100 |
| commit | edd48fd9d45370d6c8ba0dd834fcc51ff688cc87 (patch) | |
| tree | 9a2e82b83425bbd40d05152bc26278d490fb3e1c | |
| parent | b0eeba527e704d6023a6cd9103f929226e326b03 (diff) | |
pinctrl: stm32: fix array read out of bound
The existing code does not verify if the "tentative" index exceeds
the size of the array, causing out of bound read.
Issue identified with kasan.
Check the index before using it.
Signed-off-by: Antonio Borneo <[email protected]>
Fixes: 32c170ff15b0 ("pinctrl: stm32: set default gpio line names using pin names")
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Linus Walleij <[email protected]>
| -rw-r--r-- | drivers/pinctrl/stm32/pinctrl-stm32.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c index 3a9c458d3fc9..603f900e88c1 100644 --- a/drivers/pinctrl/stm32/pinctrl-stm32.c +++ b/drivers/pinctrl/stm32/pinctrl-stm32.c @@ -1273,9 +1273,11 @@ static struct stm32_desc_pin *stm32_pctrl_get_desc_pin_from_gpio(struct stm32_pi int i; /* With few exceptions (e.g. bank 'Z'), pin number matches with pin index in array */ - pin_desc = pctl->pins + stm32_pin_nb; - if (pin_desc->pin.number == stm32_pin_nb) - return pin_desc; + if (stm32_pin_nb < pctl->npins) { + pin_desc = pctl->pins + stm32_pin_nb; + if (pin_desc->pin.number == stm32_pin_nb) + return pin_desc; + } /* Otherwise, loop all array to find the pin with the right number */ for (i = 0; i < pctl->npins; i++) { |