2843a2e703
[ Upstream commit 13c088cf3657d70893d75cf116be937f1509cc0f ]
The size of array 'priv->ports[]' is INNO_PHY_PORT_NUM.
In the for loop, 'i' is used as the index for array 'priv->ports[]'
with a check (i > INNO_PHY_PORT_NUM) which indicates that
INNO_PHY_PORT_NUM is allowed value for 'i' in the same loop.
This > comparison needs to be changed to >=, otherwise it potentially leads
to an out of bounds write on the next iteration through the loop
Fixes:
|
||
---|---|---|
.. | ||
allwinner | ||
amlogic | ||
broadcom | ||
hisilicon | ||
lantiq | ||
marvell | ||
mediatek | ||
motorola | ||
qualcomm | ||
ralink | ||
renesas | ||
rockchip | ||
samsung | ||
st | ||
tegra | ||
ti | ||
Kconfig | ||
Makefile | ||
phy-core.c | ||
phy-lpc18xx-usb-otg.c | ||
phy-pistachio-usb.c | ||
phy-xgene.c |