[PATCH] stm32mp: fix array bounds checks

[Patrick DELAUNAY]

Hi,

On 2/10/26 15:57, Patrice Chotard wrote:
> Fix index check against array size. If that index is equal
> to the array size, we'll access one-past-the-end of the array.
>
> Signed-off-by: Patrice Chotard <patrice.chotard at foss.st.com>
> ---
>   arch/arm/mach-stm32mp/stm32mp2/cpu.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm/mach-stm32mp/stm32mp2/cpu.c b/arch/arm/mach-stm32mp/stm32mp2/cpu.c
> index e081dc605b8..a8a6bcf8ab4 100644
> --- a/arch/arm/mach-stm32mp/stm32mp2/cpu.c
> +++ b/arch/arm/mach-stm32mp/stm32mp2/cpu.c
> @@ -148,7 +148,7 @@ static void setup_boot_mode(void)
>   		  __func__, boot_ctx, boot_mode, instance, forced_mode);
>   	switch (boot_mode & TAMP_BOOT_DEVICE_MASK) {
>   	case BOOT_SERIAL_UART:
> -		if (instance > ARRAY_SIZE(serial_addr))
> +		if (instance >= ARRAY_SIZE(serial_addr))
>   			break;
>   		/* serial : search associated node in devicetree */
>   		sprintf(cmd, "serial@%x", serial_addr[instance]);
> @@ -178,7 +178,7 @@ static void setup_boot_mode(void)
>   		break;
>   	case BOOT_FLASH_SD:
>   	case BOOT_FLASH_EMMC:
> -		if (instance > ARRAY_SIZE(sdmmc_addr))
> +		if (instance >= ARRAY_SIZE(sdmmc_addr))
>   			break;
>   		/* search associated sdmmc node in devicetree */
>   		sprintf(cmd, "mmc@%x", sdmmc_addr[instance]);
>
> ---
> base-commit: b99da05e1538b8fa153322da82917af2aa27e1d6
> change-id: 20260210-upstream_stm32mp2_cpu_fix-bbbd24ba4f99
>
> Best regards,


Reviewed-by: Patrick Delaunay <patrick.delaunay at foss.st.com>

Thanks
Patrick