Commit edd48fd9 authored by Antonio Borneo's avatar Antonio Borneo Committed by Linus Walleij
Browse files

pinctrl: stm32: fix array read out of bound 



The existing code does not verify if the "tentative" index exceeds
the size of the array, causing out of bound read.
Issue identified with kasan.

Check the index before using it.

Signed-off-by: default avatarAntonio Borneo <antonio.borneo@foss.st.com>
Fixes: 32c170ff ("pinctrl: stm32: set default gpio line names using pin names")
Link: https://lore.kernel.org/r/20231107110520.4449-1-antonio.borneo@foss.st.com


Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
parent b0eeba52

drivers/pinctrl/stm32/pinctrl-stm32.c

+5 −3
Original line number Diff line number Diff line
@@ -1273,9 +1273,11 @@ static struct stm32_desc_pin *stm32_pctrl_get_desc_pin_from_gpio(struct stm32_pi 
	int i;



	/* With few exceptions (e.g. bank 'Z'), pin number matches with pin index in array */

	if (stm32_pin_nb < pctl->npins) {

		pin_desc = pctl->pins + stm32_pin_nb;

		if (pin_desc->pin.number == stm32_pin_nb)

			return pin_desc;

	}



	/* Otherwise, loop all array to find the pin with the right number */

	for (i = 0; i < pctl->npins; i++) {