Patch "memory: brcmstb_dpfe: fix testing array offset after use" has been added to the 5.4-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    memory: brcmstb_dpfe: fix testing array offset after use

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     memory-brcmstb_dpfe-fix-testing-array-offset-after-u.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9b02b49d7db025e04ef464355fa2fc21bf311e8b
Author: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxx>
Date:   Sat May 13 13:29:31 2023 +0200

    memory: brcmstb_dpfe: fix testing array offset after use
    
    [ Upstream commit 1d9e93fad549bc38f593147479ee063f2872c170 ]
    
    Code should first check for valid value of array offset, then use it as
    the index.  Fixes smatch warning:
    
      drivers/memory/brcmstb_dpfe.c:443 __send_command() error: testing array offset 'cmd' after use.
    
    Fixes: 2f330caff577 ("memory: brcmstb: Add driver for DPFE")
    Acked-by: Markus Mayer <mmayer@xxxxxxxxxxxx>
    Reviewed-by: Florian Fainelli <florian.fainelli@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230513112931.176066-1-krzysztof.kozlowski@xxxxxxxxxx
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
index 6827ed4847507..127a9bffdbca8 100644
--- a/drivers/memory/brcmstb_dpfe.c
+++ b/drivers/memory/brcmstb_dpfe.c
@@ -398,15 +398,17 @@ static void __finalize_command(struct private_data *priv)
 static int __send_command(struct private_data *priv, unsigned int cmd,
 			  u32 result[])
 {
-	const u32 *msg = priv->dpfe_api->command[cmd];
 	void __iomem *regs = priv->regs;
 	unsigned int i, chksum, chksum_idx;
+	const u32 *msg;
 	int ret = 0;
 	u32 resp;
 
 	if (cmd >= DPFE_CMD_MAX)
 		return -1;
 
+	msg = priv->dpfe_api->command[cmd];
+
 	mutex_lock(&priv->lock);
 
 	/* Wait for DCPU to become ready */



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux