Christophe JAILLET 49e57caf96 mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op() ... [ Upstream commit c6abce6033 ] 'op-cs' is copied in 'fun->mchip_number' which is used to access the 'mchip_offsets' and the 'rnb_gpio' arrays. These arrays have NAND_MAX_CHIPS elements, so the index must be below this limit. Fix the sanity check in order to avoid the NAND_MAX_CHIPS value. This would lead to out-of-bound accesses. Fixes: 54309d6577 ("mtd: rawnand: fsl_upm: Implement exec_op()") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://lore.kernel.org/linux-mtd/cd01cba1c7eda58bdabaae174c78c067325803d2.1689803636.git.christophe.jaillet@wanadoo.fr Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-08-11 12:14:27 +02:00
..
chips
devices	spi: Updates for v6.4	2023-04-27 11:02:26 -07:00
hyperbus
lpddr
maps	SPI NOR core changes:	2023-04-19 20:38:20 +02:00
nand	mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op()	2023-08-11 12:14:27 +02:00
parsers	Raw NAND core changes:	2023-04-19 20:39:03 +02:00
spi-nor	mtd: spi-nor: avoid holes in struct spi_mem_op	2023-08-11 12:14:26 +02:00
tests
ubi	This pull request contains updates for UBI and UBIFS	2023-05-03 18:58:59 -07:00
ftl.c
inftlcore.c
inftlmount.c
Kconfig
Makefile
mtd_blkdevs.c
mtdblock.c
mtdblock_ro.c
mtdchar.c	mtdchar: mark bits of ioctl handler noinline	2023-06-01 18:12:31 +02:00
mtdconcat.c
mtdcore.c	Driver core changes for 6.4-rc1	2023-04-27 11:53:57 -07:00
mtdcore.h
mtdoops.c
mtdpart.c
mtdpstore.c
mtdsuper.c
mtdswap.c
nftlcore.c
nftlmount.c
rfd_ftl.c
sm_ftl.c
sm_ftl.h
ssfdc.c