[PATCH] pwm: cadence-ttc: Insufficient elements in array

[Andrew Goodbody]

The Cadence TTC has 3 channels that can each be used for PWM functions.
Ensure that the array has sufficient elements to avoid a possible memory
access overrun. Use a macro to keep the array size and limit checks in
sync so adjust checks to work with this.

This issue was found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodbody at linaro.org>
---
 drivers/pwm/pwm-cadence-ttc.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/pwm/pwm-cadence-ttc.c b/drivers/pwm/pwm-cadence-ttc.c
index 767628833bc..fae6d5a1739 100644
--- a/drivers/pwm/pwm-cadence-ttc.c
+++ b/drivers/pwm/pwm-cadence-ttc.c
@@ -47,6 +47,8 @@
 #define TTC_MATCH_1_COUNTER(reg, channel) \
 	TTC_REG((reg) + MATCH_1_COUNTER, (channel))
 
+#define TTC_PWM_CHANNELS	3
+
 struct cadence_ttc_pwm_plat {
 	u8 *regs;
 	u32 timer_width;
@@ -57,7 +59,7 @@ struct cadence_ttc_pwm_priv {
 	u32 timer_width;
 	u32 timer_mask;
 	unsigned long frequency;
-	bool invert[2];
+	bool invert[TTC_PWM_CHANNELS];
 };
 
 static int cadence_ttc_pwm_set_invert(struct udevice *dev, uint channel,
@@ -65,7 +67,7 @@ static int cadence_ttc_pwm_set_invert(struct udevice *dev, uint channel,
 {
 	struct cadence_ttc_pwm_priv *priv = dev_get_priv(dev);
 
-	if (channel > 2) {
+	if (channel >= TTC_PWM_CHANNELS) {
 		dev_err(dev, "Unsupported channel number %d(max 2)\n", channel);
 		return -EINVAL;
 	}
@@ -87,7 +89,7 @@ static int cadence_ttc_pwm_set_config(struct udevice *dev, uint channel,
 	dev_dbg(dev, "channel %d, duty %d/period %d ns\n", channel,
 		duty_ns, period_ns);
 
-	if (channel > 2) {
+	if (channel >= TTC_PWM_CHANNELS) {
 		dev_err(dev, "Unsupported channel number %d(max 2)\n", channel);
 		return -EINVAL;
 	}
@@ -153,7 +155,7 @@ static int cadence_ttc_pwm_set_enable(struct udevice *dev, uint channel,
 {
 	struct cadence_ttc_pwm_priv *priv = dev_get_priv(dev);
 
-	if (channel > 2) {
+	if (channel >= TTC_PWM_CHANNELS) {
 		dev_err(dev, "Unsupported channel number %d(max 2)\n", channel);
 		return -EINVAL;
 	}

---
base-commit: 4a2f360bd280b2b5af1c5daffbc189590c83c995
change-id: 20250901-cadence_pwm-61d1815e7752

Best regards,
-- 
Andrew Goodbody <andrew.goodbody at linaro.org>