Commit 810e154d authored by Junjie Cao's avatar Junjie Cao Committed by Bartosz Golaszewski
Browse files

gpio: timberdale: fix off-by-one in IRQ type boundary check 



timbgpio_irq_type() currently accepts offset == ngpio, violating
gpiolib's [0..ngpio-1] contract. This can lead to undefined behavior
when computing '1 << offset', and it is also inconsistent with users
that iterate with for_each_set_bit(..., ngpio).

Tighten the upper bound to reject offset == ngpio. No functional change
for in-range offsets.

Signed-off-by: default avatarJunjie Cao <junjie.cao@intel.com>
Link: https://lore.kernel.org/r/20250825090850.127163-1-junjie.cao@intel.com


Signed-off-by: default avatarBartosz Golaszewski <bartosz.golaszewski@linaro.org>
parent 1b237f19

drivers/gpio/gpio-timberdale.c

+1 −1
Original line number Diff line number Diff line
@@ -137,7 +137,7 @@ static int timbgpio_irq_type(struct irq_data *d, unsigned trigger) 
	u32 ver;

	int ret = 0;



	if (offset < 0 || offset > tgpio->gpio.ngpio)

	if (offset < 0 || offset >= tgpio->gpio.ngpio)

		return -EINVAL;



	ver = ioread32(tgpio->membase + TGPIO_VER);