Commit ea17fc4d authored by Xiangxu Yin's avatar Xiangxu Yin Committed by Vinod Koul
Browse files

phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config 



swing_tbl and pre_emphasis_tbl are 4x4 arrays (valid indices 0-3), but
the boundary check uses "> 4" instead of ">= 4", allowing index 4 to
cause an out-of-bounds access.

Reported-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Fixes: 81791c45 ("phy: qcom: qmp-usbc: Add QCS615 USB/DP PHY config and DP mode support")
Signed-off-by: default avatarXiangxu Yin <xiangxu.yin@oss.qualcomm.com>
Reviewed-by: default avatarDmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: default avatarKonrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260227-master-v1-1-8d91b9407fdb@oss.qualcomm.com


Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
parent 1854082f

drivers/phy/qualcomm/phy-qcom-qmp-usbc.c

+1 −1
Original line number Diff line number Diff line
@@ -794,7 +794,7 @@ static int qmp_v2_configure_dp_swing(struct qmp_usbc *qmp) 
		p_level = max(p_level, dp_opts->pre[i]);

	}



	if (v_level > 4 || p_level > 4) {

	if (v_level >= 4 || p_level >= 4) {

		dev_err(qmp->dev, "Invalid v(%d) | p(%d) level)\n",

			v_level, p_level);

		return -EINVAL;