raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 18:09:56 +00:00
Code Issues Projects Releases Wiki Activity

mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop

Browse Source 
[ Upstream commit 0aead8197f ]

The cleanup loop was starting at the wrong array index, causing
out-of-bounds access.
Start the loop at the correct index for zero-indexed arrays to prevent
accessing memory beyond the allocated array bounds.

Fixes: 4981b82ba2 ("mailbox: ZynqMP IPI mailbox controller")
Signed-off-by: Harini T <harini.t@amd.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Harini T
2025-09-29 13:07:22 +05:30
committed by Greg Kroah-Hartman
parent 66ca91400d
commit ab96f08ece
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/mailbox/zynqmp-ipi-mailbox.c
View File

@@ -890,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
if (pdata->irq < MAX_SGI) if (pdata->irq < MAX_SGI)
xlnx_mbox_cleanup_sgi(pdata); xlnx_mbox_cleanup_sgi(pdata);
i = pdata->num_mboxes; i = pdata->num_mboxes - 1;
for (; i >= 0; i--) { for (; i >= 0; i--) {
ipi_mbox = &pdata->ipi_mboxes[i]; ipi_mbox = &pdata->ipi_mboxes[i];
if (device_is_registered(&ipi_mbox->dev)) if (device_is_registered(&ipi_mbox->dev))