Skip to content

Commit cabd25b

Browse files
Dan Carpentervinodkoul
authored andcommitted
phy: stm32-usphyc: Fix off by one in probe()
The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one element out of bounds. The "index" comes from the device tree so it's data that we trust and it's unlikely to be wrong, however it's obviously still worth fixing the bug. Change the > to >=. Fixes: 94c358d ("phy: stm32: add support for STM32 USB PHY Controller (USBPHYC)") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com> Link: https://patch.msgid.link/aTfHcMJK1wFVnvEe@stanley.mountain Signed-off-by: Vinod Koul <vkoul@kernel.org>
1 parent 1ca52c0 commit cabd25b

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

drivers/phy/st/phy-stm32-usbphyc.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -712,7 +712,7 @@ static int stm32_usbphyc_probe(struct platform_device *pdev)
712712
}
713713

714714
ret = of_property_read_u32(child, "reg", &index);
715-
if (ret || index > usbphyc->nphys) {
715+
if (ret || index >= usbphyc->nphys) {
716716
dev_err(&phy->dev, "invalid reg property: %d\n", ret);
717717
if (!ret)
718718
ret = -EINVAL;

0 commit comments

Comments
 (0)