diff options
| author | Dan Carpenter <dan.carpenter@linaro.org> | 2024-11-30 13:07:56 +0300 |
|---|---|---|
| committer | Viresh Kumar <viresh.kumar@linaro.org> | 2024-12-23 16:27:23 +0530 |
| commit | 402074f0105e93154409e4a86c02d09e5199d9a5 (patch) | |
| tree | 72bdbd25fbb23f96f2e5dbd58bf191ef18aa8e04 | |
| parent | b89c0ed09e1189217cd9d516b739627c523d53a4 (diff) | |
opp: core: Fix off by one in dev_pm_opp_get_bw()
The "opp->bandwidth" array has "opp->opp_table->path_count" number of
elements. It's allocated in _opp_allocate(). So this > needs to be >=
to prevent an out of bounds access.
Fixes: d78653dcd8bf ("opp: core: implement dev_pm_opp_get_bw")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
| -rw-r--r-- | drivers/opp/core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/opp/core.c b/drivers/opp/core.c index d4a0030a0228..09a1432561f6 100644 --- a/drivers/opp/core.c +++ b/drivers/opp/core.c @@ -121,7 +121,7 @@ unsigned long dev_pm_opp_get_bw(struct dev_pm_opp *opp, bool peak, int index) return 0; } - if (index > opp->opp_table->path_count) + if (index >= opp->opp_table->path_count) return 0; if (!opp->bandwidth) |