Commit 0aead819 authored by Harini T's avatar Harini T Committed by Jassi Brar
Browse files

mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop 



The cleanup loop was starting at the wrong array index, causing
out-of-bounds access.
Start the loop at the correct index for zero-indexed arrays to prevent
accessing memory beyond the allocated array bounds.

Fixes: 4981b82b ("mailbox: ZynqMP IPI mailbox controller")
Signed-off-by: default avatarHarini T <harini.t@amd.com>
Reviewed-by: default avatarPeng Fan <peng.fan@nxp.com>
Signed-off-by: default avatarJassi Brar <jassisinghbrar@gmail.com>
parent 019e3f45

drivers/mailbox/zynqmp-ipi-mailbox.c

+1 −1
Original line number Diff line number Diff line
@@ -890,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) 
	if (pdata->irq < MAX_SGI)

		xlnx_mbox_cleanup_sgi(pdata);



	i = pdata->num_mboxes;

	i = pdata->num_mboxes - 1;

	for (; i >= 0; i--) {

		ipi_mbox = &pdata->ipi_mboxes[i];

		if (device_is_registered(&ipi_mbox->dev))