[PATCH] ram: renesas: dbsc5: Fix off by 1 errors

Marek Vasut marek.vasut at mailbox.org
Wed Aug 20 22:47:12 CEST 2025


On 8/8/25 1:32 PM, Andrew Goodbody wrote:
> In dbsc5_read_vref_training the arrays dvw_min_byte0_table and
> dvw_min_byte1_table have 128 elements per channel. The variable
> vref_stop_index is limited to be a maximum of 128. This means that the
> index used to access the arrays must use a test of '< vref_stop_index'
> rather than '<= vref_stop_index' in order to prevent out of bounds
> accesses to the arrays.
> 
> This issue was found by Smatch.
> 
> Signed-off-by: Andrew Goodbody <andrew.goodbody at linaro.org>
This is a real nice find, thank you.

Reviewed-by: Marek Vasut <marek.vasut+renesas at mailbox.org>
Tested-by: Marek Vasut <marek.vasut+renesas at mailbox.org>


More information about the U-Boot mailing list