thunderbolt: Fix off by one in tb_port_find_retimer()

Dan Carpenter · westeri · commit 08fe7ae18570 · 2021-03-30T13:38:10.000+03:00
This array uses 1-based indexing so it corrupts memory one element beyond of the array. Fix it by making the array one element larger. Fixes: dacb128 ("thunderbolt: Add support for on-board retimers") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
diff --git a/drivers/thunderbolt/retimer.c b/drivers/thunderbolt/retimer.c
@@ -406,7 +406,7 @@ static struct tb_retimer *tb_port_find_retimer(struct tb_port *port, u8 index)
  */
 int tb_retimer_scan(struct tb_port *port)
 {
-	u32 status[TB_MAX_RETIMER_INDEX] = {};
+	u32 status[TB_MAX_RETIMER_INDEX + 1] = {};
 	int ret, i, last_idx = 0;
 
 	if (!port->cap_usb4)

Original file line number	Diff line number	Diff line change
`@@ -406,7 +406,7 @@ static struct tb_retimer tb_port_find_retimer(struct tb_port port, u8 index)`
`406`	`406`	`*/`
`407`	`407`	`int tb_retimer_scan(struct tb_port *port)`
`408`	`408`	`{`
`409`		`- u32 status[TB_MAX_RETIMER_INDEX] = {};`
	`409`	`+ u32 status[TB_MAX_RETIMER_INDEX + 1] = {};`
`410`	`410`	`int ret, i, last_idx = 0;`
`411`	`411`
`412`	`412`	`if (!port->cap_usb4)`