lkml.org 
[lkml]   [2021]   [Apr]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 072/188] thunderbolt: Fix off by one in tb_port_find_retimer()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit 08fe7ae1857080f5075df5ac7fef2ecd4e289117 upstream.

    This array uses 1-based indexing so it corrupts memory one element
    beyond of the array. Fix it by making the array one element larger.

    Fixes: dacb12877d92 ("thunderbolt: Add support for on-board retimers")
    Cc: stable@vger.kernel.org
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/thunderbolt/retimer.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/thunderbolt/retimer.c
    +++ b/drivers/thunderbolt/retimer.c
    @@ -406,7 +406,7 @@ static struct tb_retimer *tb_port_find_r
    */
    int tb_retimer_scan(struct tb_port *port)
    {
    - u32 status[TB_MAX_RETIMER_INDEX] = {};
    + u32 status[TB_MAX_RETIMER_INDEX + 1] = {};
    int ret, i, last_idx = 0;

    if (!port->cap_usb4)

    \
     
     \ /
      Last update: 2021-04-12 11:11    [W:4.365 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site