Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 72ca0df0 authored by Yuanfang Zhang's avatar Yuanfang Zhang
Browse files

coresight: tgu: fix array access violation 



The maximum value of grp_refcnt is greater than the upper bound of
the array grp_data, so accessing the array through it will cause
array out-of-bounds problem.

Change-Id: I8311d5f5916aa4fb05f235986acc494156c39937
Signed-off-by: default avatarYuanfang Zhang <zhangyuanfang@codeaurora.org>
parent b99dda15

drivers/hwtracing/coresight/coresight-tgu.c

+5 −5
Original line number Diff line number Diff line
@@ -132,7 +132,7 @@ static ssize_t enable_tgu_store(struct device *dev, 


		/* program the TGU Group data for the desired use case*/



		for (i = 0; i <= drvdata->grp_refcnt; i++)

		for (i = 0; i < drvdata->grp_refcnt; i++)

			tgu_writel(drvdata, drvdata->grp_data[i].value,

						drvdata->grp_data[i].grpaddr);
@@ -143,21 +143,21 @@ static ssize_t enable_tgu_store(struct device *dev, 
						CONDITION_DECODE_STEP(i, j));

		}

		/* program the TGU Condition Decode for the desired use case*/

		for (i = 0; i <= drvdata->cond_refcnt; i++)

		for (i = 0; i < drvdata->cond_refcnt; i++)

			tgu_writel(drvdata, drvdata->condition_data[i].value,

					drvdata->condition_data[i].condaddr);



		/* program the TGU Condition Select for the desired use case*/

		for (i = 0; i <= drvdata->select_refcnt; i++)

		for (i = 0; i < drvdata->select_refcnt; i++)

			tgu_writel(drvdata, drvdata->select_data[i].value,

					drvdata->select_data[i].selectaddr);



		/*  Timer and Counter Check */

		for (i = 0; i <= drvdata->timer_refcnt; i++)

		for (i = 0; i < drvdata->timer_refcnt; i++)

			tgu_writel(drvdata, drvdata->timer_data[i].value,

					drvdata->timer_data[i].timeraddr);



		for (i = 0; i <= drvdata->counter_refcnt; i++)

		for (i = 0; i < drvdata->counter_refcnt; i++)

			tgu_writel(drvdata, drvdata->counter_data[i].value,

					drvdata->counter_data[i].counteraddr);