Skip to content

Commit edd48fd

Browse files
AntonioBorneoLinus Walleij
authored andcommitted
pinctrl: stm32: fix array read out of bound
The existing code does not verify if the "tentative" index exceeds the size of the array, causing out of bound read. Issue identified with kasan. Check the index before using it. Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com> Fixes: 32c170f ("pinctrl: stm32: set default gpio line names using pin names") Link: https://lore.kernel.org/r/20231107110520.4449-1-antonio.borneo@foss.st.com Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
1 parent b0eeba5 commit edd48fd

1 file changed

Lines changed: 5 additions & 3 deletions

File tree

drivers/pinctrl/stm32/pinctrl-stm32.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1273,9 +1273,11 @@ static struct stm32_desc_pin *stm32_pctrl_get_desc_pin_from_gpio(struct stm32_pi
12731273
int i;
12741274

12751275
/* With few exceptions (e.g. bank 'Z'), pin number matches with pin index in array */
1276-
pin_desc = pctl->pins + stm32_pin_nb;
1277-
if (pin_desc->pin.number == stm32_pin_nb)
1278-
return pin_desc;
1276+
if (stm32_pin_nb < pctl->npins) {
1277+
pin_desc = pctl->pins + stm32_pin_nb;
1278+
if (pin_desc->pin.number == stm32_pin_nb)
1279+
return pin_desc;
1280+
}
12791281

12801282
/* Otherwise, loop all array to find the pin with the right number */
12811283
for (i = 0; i < pctl->npins; i++) {

0 commit comments

Comments
 (0)