diff options
| author | Dan Carpenter <dan.carpenter@linaro.org> | 2025-08-13 08:38:27 +0300 |
|---|---|---|
| committer | Bartosz Golaszewski <bartosz.golaszewski@linaro.org> | 2025-08-13 10:22:59 +0300 |
| commit | 148547000cfc1ba8cec02857268333d08724b9cc (patch) | |
| tree | a38f6d033c0a0ad0a197e6559e1e32d951107074 /drivers/gpio/gpio-aggregator.c | |
| parent | 38f7b4a6a0510bc9b578b2bbf31e434d84b3244b (diff) | |
| download | linux-148547000cfc1ba8cec02857268333d08724b9cc.tar.xz | |
gpio: aggregator: Fix off by one in gpiochip_fwd_desc_add()
The "> chip->ngpio" comparison here needs to be ">= chip->ngpio",
otherwise it leads to an out of bounds access. The fwd->valid_mask
bitmap only has chip->ngpio bits and the fwd->descs[] array has that
same number of elements. These values are set in
devm_gpiochip_fwd_alloc().
Fixes: c44ce91b8ada ("gpio: aggregator: refactor the code to add GPIO desc in the forwarder")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/aJwk0yBSCccGCjX3@stanley.mountain
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Diffstat (limited to 'drivers/gpio/gpio-aggregator.c')
| -rw-r--r-- | drivers/gpio/gpio-aggregator.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpio/gpio-aggregator.c b/drivers/gpio/gpio-aggregator.c index 0ef6556f98b1..37600faf4a4b 100644 --- a/drivers/gpio/gpio-aggregator.c +++ b/drivers/gpio/gpio-aggregator.c @@ -744,7 +744,7 @@ int gpiochip_fwd_desc_add(struct gpiochip_fwd *fwd, struct gpio_desc *desc, { struct gpio_chip *chip = &fwd->chip; - if (offset > chip->ngpio) + if (offset >= chip->ngpio) return -EINVAL; if (test_and_set_bit(offset, fwd->valid_mask)) |