[PATCH] soc: soc_ti_k3: fix revision array bounds checks

Rasmus Villemoes rasmus.villemoes at prevas.dk
Fri Mar 24 08:44:29 CET 2023


If rev is equal to the array size, we'll access the array
one-past-the-end.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes at prevas.dk>
---
 drivers/soc/soc_ti_k3.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/soc_ti_k3.c b/drivers/soc/soc_ti_k3.c
index 8af0ac7051..2182532236 100644
--- a/drivers/soc/soc_ti_k3.c
+++ b/drivers/soc/soc_ti_k3.c
@@ -82,12 +82,12 @@ static const char *get_rev_string(u32 idreg)
 
 	switch (soc) {
 	case J721E:
-		if (rev > ARRAY_SIZE(j721e_rev_string_map))
+		if (rev >= ARRAY_SIZE(j721e_rev_string_map))
 			goto bail;
 		return j721e_rev_string_map[rev];
 
 	default:
-		if (rev > ARRAY_SIZE(typical_rev_string_map))
+		if (rev >= ARRAY_SIZE(typical_rev_string_map))
 			goto bail;
 		return typical_rev_string_map[rev];
 	};
-- 
2.37.2



More information about the U-Boot mailing list