hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id()

Dan Carpenter · gregkh · commit fed87ce073c7 · 2023-05-11T23:03:38.000+09:00
[ Upstream commit e078180 ] The "map_sz" is the number of elements in the "m" array so the > comparison needs to be changed to >= to prevent an out of bounds read. Fixes: 09574cc ("hte: Add Tegra194 HTE kernel provider") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Acked-by: Dipen Patel <dipenp@nvidia.com> Signed-off-by: Dipen Patel <dipenp@nvidia.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
diff --git a/drivers/hte/hte-tegra194.c b/drivers/hte/hte-tegra194.c
@@ -251,7 +251,7 @@ static int tegra_hte_map_to_line_id(u32 eid,
 {
 
 	if (m) {
-		if (eid > map_sz)
+		if (eid >= map_sz)
 			return -EINVAL;
 		if (m[eid].slice == NV_AON_SLICE_INVALID)
 			return -EINVAL;

Original file line number	Diff line number	Diff line change
`@@ -251,7 +251,7 @@ static int tegra_hte_map_to_line_id(u32 eid,`
`251`	`251`	`{`
`252`	`252`
`253`	`253`	`if (m) {`
`254`		`- if (eid > map_sz)`
	`254`	`+ if (eid >= map_sz)`
`255`	`255`	`return -EINVAL;`
`256`	`256`	`if (m[eid].slice == NV_AON_SLICE_INVALID)`
`257`	`257`	`return -EINVAL;`