diff mbox series

[4.9,087/139] memory: omap-gpmc: Fix a couple off by ones

Message ID	20201027134906.262078089@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=OPSA=EC=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Dan Carpenter <dan.carpenter@oracle.com>, Roger Quadros <rogerq@ti.com>, Krzysztof Kozlowski <krzk@kernel.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 4.9 087/139] memory: omap-gpmc: Fix a couple off by ones Date: Tue, 27 Oct 2020 14:49:41 +0100 Message-Id: <20201027134906.262078089@linuxfoundation.org> In-Reply-To: <20201027134902.130312227@linuxfoundation.org> References: <20201027134902.130312227@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.9,002/139] tipc: fix the skb_unshare() in tipc_buf_append() [4.9,003/139] net/ipv4: always honour route mtu during forwarding [4.9,004/139] r8169: fix data corruption issue on RTL8402 [4.9,005/139] ALSA: bebob: potential info leak in hwdep_read() [4.9,006/139] net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device [4.9,007/139] net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup [4.9,008/139] nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download() [4.9,009/139] tcp: fix to update snd_wl1 in bulk receiver fast path [4.9,010/139] icmp: randomize the global rate limiter [4.9,011/139] cifs: remove bogus debug code [4.9,012/139] KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages [4.9,013/139] ima: Dont ignore errors from crypto_shash_update() [4.9,014/139] crypto: algif_aead - Do not set MAY_BACKLOG on the async path [4.9,015/139] EDAC/i5100: Fix error handling order in i5100_init_one() [4.9,016/139] crypto: ixp4xx - Fix the size used in a dma_free_coherent() call [4.9,017/139] media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()" [4.9,018/139] media: m5mols: Check function pointer in m5mols_sensor_power [4.9,019/139] media: omap3isp: Fix memleak in isp_probe [4.9,020/139] crypto: omap-sham - fix digcnt register handling with export/import [4.9,021/139] media: tc358743: initialize variable [4.9,022/139] media: platform: fcp: Fix a reference count leak. [4.9,023/139] media: ti-vpe: Fix a missing check and reference count leak [4.9,024/139] regulator: resolve supply after creating regulator [4.9,025/139] ath10k: provide survey info as accumulated data [4.9,026/139] ath6kl: prevent potential array overflow in ath6kl_add_new_sta() [4.9,027/139] ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() [4.9,028/139] wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 [4.9,029/139] ASoC: qcom: lpass-platform: fix memory leak [4.9,030/139] mwifiex: Do not use GFP_KERNEL in atomic context [4.9,031/139] drm/gma500: fix error check [4.9,032/139] scsi: qla4xxx: Fix an error handling path in qla4xxx_get_host_stats() [4.9,033/139] scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() [4.9,034/139] backlight: sky81452-backlight: Fix refcount imbalance on error [4.9,035/139] VMCI: check return value of get_user_pages_fast() for errors [4.9,036/139] tty: serial: earlycon dependency [4.9,037/139] tty: hvcs: Dont NULL tty->driver_data until hvcs_cleanup() [4.9,038/139] pty: do tty_flip_buffer_push without port->lock in pty_write [4.9,039/139] drivers/virt/fsl_hypervisor: Fix error handling path [4.9,040/139] video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error [4.9,041/139] video: fbdev: sis: fix null ptr dereference [4.9,042/139] HID: roccat: add bounds checking in kone_sysfs_write_settings() [4.9,043/139] ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd() [4.9,044/139] misc: mic: scif: Fix error handling path [4.9,045/139] ALSA: seq: oss: Avoid mutex lock for a long-time ioctl [4.9,046/139] quota: clear padding in v2r1_mem2diskdqb() [4.9,047/139] net: enic: Cure the enic api locking trainwreck [4.9,048/139] mfd: sm501: Fix leaks in probe() [4.9,049/139] iwlwifi: mvm: split a print to avoid a WARNING in ROC [4.9,050/139] usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above. [4.9,051/139] usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well [4.9,052/139] nl80211: fix non-split wiphy information [4.9,053/139] scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs() [4.9,054/139] mwifiex: fix double free [4.9,055/139] net: korina: fix kfree of rx/tx descriptor array [4.9,056/139] IB/mlx4: Fix starvation in paravirt mux/demux [4.9,057/139] IB/mlx4: Adjust delayed work when a dup is observed [4.9,058/139] powerpc/pseries: Fix missing of_node_put() in rng_init() [4.9,059/139] powerpc/icp-hv: Fix missing of_node_put() in success path [4.9,060/139] mtd: lpddr: fix excessive stack usage with clang [4.9,061/139] mtd: mtdoops: Dont write panic data twice [4.9,062/139] ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT values [4.9,063/139] RDMA/qedr: Fix use of uninitialized field [4.9,064/139] powerpc/tau: Use appropriate temperature sample interval [4.9,065/139] powerpc/tau: Remove duplicated set_thresholds() call [4.9,066/139] powerpc/tau: Disable TAU between measurements [4.9,067/139] perf intel-pt: Fix "context_switch event has no tid" error [4.9,068/139] RDMA/hns: Set the unsupported wr opcode [4.9,069/139] kdb: Fix pager search for multi-line strings [4.9,070/139] overflow: Include header file with SIZE_MAX declaration [4.9,071/139] powerpc/perf: Exclude pmc5/6 from the irrelevant PMU group constraints [4.9,072/139] powerpc/perf/hv-gpci: Fix starting index value [4.9,073/139] cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_reboot_notifier [4.9,074/139] IB/rdmavt: Fix sizeof mismatch [4.9,075/139] lib/crc32.c: fix trivial typo in preprocessor condition [4.9,076/139] rapidio: fix error handling path [4.9,077/139] rapidio: fix the missed put_device() for rio_mport_add_riodev [4.9,078/139] clk: at91: clk-main: update key before writing AT91_CKGR_MOR [4.9,079/139] clk: bcm2835: add missing release if devm_clk_hw_register fails [4.9,080/139] vfio/pci: Clear token on bypass registration failure [4.9,081/139] Input: imx6ul_tsc - clean up some errors in imx6ul_tsc_resume() [4.9,082/139] Input: ep93xx_keypad - fix handling of platform_get_irq() error [4.9,083/139] Input: omap4-keypad - fix handling of platform_get_irq() error [4.9,084/139] Input: twl4030_keypad - fix handling of platform_get_irq() error [4.9,085/139] Input: sun4i-ps2 - fix handling of platform_get_irq() error [4.9,086/139] KVM: x86: emulating RDPID failure shall return #UD rather than #GP [4.9,087/139] memory: omap-gpmc: Fix a couple off by ones [4.9,088/139] memory: fsl-corenet-cf: Fix handling of platform_get_irq() error [4.9,089/139] arm64: dts: qcom: msm8916: Fix MDP/DSI interrupts [4.9,090/139] arm64: dts: zynqmp: Remove additional compatible string for i2c IPs [4.9,091/139] powerpc/powernv/dump: Fix race while processing OPAL dump [4.9,092/139] nvmet: fix uninitialized work for zero kato [4.9,093/139] NTB: hw: amd: fix an issue about leak system resources [4.9,094/139] crypto: ccp - fix error handling [4.9,095/139] media: firewire: fix memory leak [4.9,096/139] media: ati_remote: sanity check for both endpoints [4.9,097/139] media: exynos4-is: Fix several reference count leaks due to pm_runtime_get_sync [4.9,098/139] media: exynos4-is: Fix a reference count leak due to pm_runtime_get_sync [4.9,099/139] media: exynos4-is: Fix a reference count leak [4.9,100/139] media: vsp1: Fix runtime PM imbalance on error [4.9,101/139] media: platform: s3c-camif: Fix runtime PM imbalance on error [4.9,102/139] media: platform: sti: hva: Fix runtime PM imbalance on error [4.9,103/139] media: bdisp: Fix runtime PM imbalance on error [4.9,104/139] media: media/pci: prevent memory leak in bttv_probe [4.9,105/139] media: uvcvideo: Ensure all probed info is returned to v4l2 [4.9,106/139] mmc: sdio: Check for CISTPL_VERS_1 buffer size [4.9,107/139] media: saa7134: avoid a shift overflow [4.9,108/139] fs: dlm: fix configfs memory leak [4.9,109/139] ntfs: add check for mft record size in superblock [4.9,110/139] PM: hibernate: remove the bogus call to get_gendisk() in software_resume() [4.9,111/139] scsi: mvumi: Fix error return in mvumi_io_attach() [4.9,112/139] scsi: target: core: Add CONTROL field for trace events [4.9,113/139] mic: vop: copy data to kernel space then write to io memory [4.9,114/139] misc: vop: add round_up(x,4) for vring_size to avoid kernel panic [4.9,115/139] usb: gadget: function: printer: fix use-after-free in __lock_acquire [4.9,116/139] udf: Limit sparing table size [4.9,117/139] udf: Avoid accessing uninitialized data on failed inode read [4.9,118/139] USB: cdc-acm: handle broken union descriptors [4.9,119/139] ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs() [4.9,120/139] misc: rtsx: Fix memory leak in rtsx_pci_probe [4.9,121/139] reiserfs: only call unlock_new_inode() if I_NEW [4.9,122/139] xfs: make sure the rt allocator doesnt run off the end [4.9,123/139] usb: ohci: Default to per-port over-current protection [4.9,124/139] Bluetooth: Only mark socket zapped after unlocking [4.9,125/139] scsi: ibmvfc: Fix error return in ibmvfc_probe() [4.9,126/139] brcmsmac: fix memory leak in wlc_phy_attach_lcnphy [4.9,127/139] rtl8xxxu: prevent potential memory leak [4.9,128/139] Fix use after free in get_capset_info callback. [4.9,129/139] tty: ipwireless: fix error handling [4.9,130/139] ipvs: Fix uninit-value in do_ip_vs_set_ctl() [4.9,131/139] reiserfs: Fix memory leak in reiserfs_parse_options() [4.9,132/139] brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach [4.9,133/139] usb: core: Solve race condition in anchor cleanup functions [4.9,134/139] ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n() [4.9,135/139] net: korina: cast KSEG0 address to pointer in kfree [4.9,136/139] usb: cdc-acm: add quirk to blacklist ETAS ES58X devices [4.9,137/139] USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync(). [4.9,138/139] eeprom: at25: set minimum read/write access stride to 1 [4.9,139/139] usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets.

Commit Message

Greg KH Oct. 27, 2020, 1:49 p.m. UTC

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 4c54228ac8fd55044195825873c50a524131fa53 ]

These comparisons should be >= instead of > to prevent reading one
element beyond the end of the gpmc_cs[] array.

Fixes: cdd6928c589a ("ARM: OMAP2+: Add device-tree support for NOR flash")
Fixes: f37e4580c409 ("ARM: OMAP2: Dynamic allocator for GPMC memory space")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Roger Quadros <rogerq@ti.com>
Link: https://lore.kernel.org/r/20200825104707.GB278587@mwanda
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/omap-gpmc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff mbox series

Patch

diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index bf0fe0137dfed..a9d47c06f80f3 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -951,7 +951,7 @@  static int gpmc_cs_remap(int cs, u32 base)
 	int ret;
 	u32 old_base, size;
 
-	if (cs > gpmc_cs_num) {
+	if (cs >= gpmc_cs_num) {
 		pr_err("%s: requested chip-select is disabled\n", __func__);
 		return -ENODEV;
 	}
@@ -986,7 +986,7 @@  int gpmc_cs_request(int cs, unsigned long size, unsigned long *base)
 	struct resource *res = &gpmc->mem;
 	int r = -1;
 
-	if (cs > gpmc_cs_num) {
+	if (cs >= gpmc_cs_num) {
 		pr_err("%s: requested chip-select is disabled\n", __func__);
 		return -ENODEV;
 	}