diff options
| author | Alban Bedel <alban.bedel@lht.dlh.de> | 2026-06-11 18:40:05 +0200 |
|---|---|---|
| committer | Danilo Krummrich <dakr@kernel.org> | 2026-07-18 16:07:22 +0200 |
| commit | ba3dedcf3bd47017307595a7e54924198f018246 (patch) | |
| tree | f33c8d7f6e4ead69f8443d71d2c6228aa960f837 /drivers/base | |
| parent | c3a280ff728a9039c72cd64ad0b32bc3a28c25b2 (diff) | |
software node: Fix software_node_get_reference_args() with index -1
The bounds check for the index passed to
software_node_get_reference_args() was failing when passed UINT_MAX,
this in turn would lead to an out of bound access in the property
array. Fix the bound check to also cover the UINT_MAX case.
Fixes: 31e4e12e0e960 ("software node: Correct a OOB check in software_node_get_reference_args()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-devicetree/20260611103904.7CB131F00893@smtp.kernel.org/
Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
Link: https://patch.msgid.link/20260611164005.2930205-1-alban.bedel@lht.dlh.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/base')
| -rw-r--r-- | drivers/base/swnode.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c index 1f2315858cc3..84a77ffa3dc4 100644 --- a/drivers/base/swnode.c +++ b/drivers/base/swnode.c @@ -537,7 +537,7 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode, if (prop->is_inline) return -EINVAL; - if ((index + 1) * sizeof(*ref) > prop->length) + if (index >= prop->length / sizeof(*ref)) return -ENOENT; ref_array = prop->pointer; |