From: Dan Carpenter dan.carpenter@linaro.org
[ Upstream commit e078180d66848a6a890daf0a3ce28dc43cc66790 ]
The "map_sz" is the number of elements in the "m" array so the > comparison needs to be changed to >= to prevent an out of bounds read.
Fixes: 09574cca6ad6 ("hte: Add Tegra194 HTE kernel provider") Signed-off-by: Dan Carpenter dan.carpenter@linaro.org Acked-by: Dipen Patel dipenp@nvidia.com Signed-off-by: Dipen Patel dipenp@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hte/hte-tegra194.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hte/hte-tegra194.c b/drivers/hte/hte-tegra194.c index 49a27af22742b..d1b579c822797 100644 --- a/drivers/hte/hte-tegra194.c +++ b/drivers/hte/hte-tegra194.c @@ -251,7 +251,7 @@ static int tegra_hte_map_to_line_id(u32 eid, {
if (m) { - if (eid > map_sz) + if (eid >= map_sz) return -EINVAL; if (m[eid].slice == NV_AON_SLICE_INVALID) return -EINVAL;