[PATCH] pwm: cadence-ttc: Insufficient elements in array

[Michal Simek]

On 9/1/25 19:00, Andrew Goodbody wrote:
> The Cadence TTC has 3 channels that can each be used for PWM functions.
> Ensure that the array has sufficient elements to avoid a possible memory
> access overrun. Use a macro to keep the array size and limit checks in
> sync so adjust checks to work with this.
> 
> This issue was found by Smatch.
> 
> Signed-off-by: Andrew Goodbody <andrew.goodbody at linaro.org>
> ---
>   drivers/pwm/pwm-cadence-ttc.c | 10 ++++++----
>   1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/pwm/pwm-cadence-ttc.c b/drivers/pwm/pwm-cadence-ttc.c
> index 767628833bc..fae6d5a1739 100644
> --- a/drivers/pwm/pwm-cadence-ttc.c
> +++ b/drivers/pwm/pwm-cadence-ttc.c
> @@ -47,6 +47,8 @@
>   #define TTC_MATCH_1_COUNTER(reg, channel) \
>   	TTC_REG((reg) + MATCH_1_COUNTER, (channel))
>   
> +#define TTC_PWM_CHANNELS	3
> +
>   struct cadence_ttc_pwm_plat {
>   	u8 *regs;
>   	u32 timer_width;
> @@ -57,7 +59,7 @@ struct cadence_ttc_pwm_priv {
>   	u32 timer_width;
>   	u32 timer_mask;
>   	unsigned long frequency;
> -	bool invert[2];
> +	bool invert[TTC_PWM_CHANNELS];
>   };
>   
>   static int cadence_ttc_pwm_set_invert(struct udevice *dev, uint channel,
> @@ -65,7 +67,7 @@ static int cadence_ttc_pwm_set_invert(struct udevice *dev, uint channel,
>   {
>   	struct cadence_ttc_pwm_priv *priv = dev_get_priv(dev);
>   
> -	if (channel > 2) {
> +	if (channel >= TTC_PWM_CHANNELS) {
>   		dev_err(dev, "Unsupported channel number %d(max 2)\n", channel);
>   		return -EINVAL;
>   	}
> @@ -87,7 +89,7 @@ static int cadence_ttc_pwm_set_config(struct udevice *dev, uint channel,
>   	dev_dbg(dev, "channel %d, duty %d/period %d ns\n", channel,
>   		duty_ns, period_ns);
>   
> -	if (channel > 2) {
> +	if (channel >= TTC_PWM_CHANNELS) {
>   		dev_err(dev, "Unsupported channel number %d(max 2)\n", channel);
>   		return -EINVAL;
>   	}
> @@ -153,7 +155,7 @@ static int cadence_ttc_pwm_set_enable(struct udevice *dev, uint channel,
>   {
>   	struct cadence_ttc_pwm_priv *priv = dev_get_priv(dev);
>   
> -	if (channel > 2) {
> +	if (channel >= TTC_PWM_CHANNELS) {
>   		dev_err(dev, "Unsupported channel number %d(max 2)\n", channel);
>   		return -EINVAL;
>   	}
> 
> ---
> base-commit: 4a2f360bd280b2b5af1c5daffbc189590c83c995
> change-id: 20250901-cadence_pwm-61d1815e7752
> 
> Best regards,

Applied.
M