diff options
| author | Andrew Goodbody <andrew.goodbody@linaro.org> | 2025-08-08 12:32:36 +0100 |
|---|---|---|
| committer | Marek Vasut <marek.vasut+renesas@mailbox.org> | 2025-08-20 23:02:55 +0200 |
| commit | b34b18a2c936c02c42c1c66bee274fcc96e25c57 (patch) | |
| tree | 699f654d774d19f0c8f92641f2c6e7215f880923 | |
| parent | 54fbdd408873413af86d86de03a490c5abf280f1 (diff) | |
ram: renesas: dbsc5: Fix off by 1 errors
In dbsc5_read_vref_training the arrays dvw_min_byte0_table and
dvw_min_byte1_table have 128 elements per channel. The variable
vref_stop_index is limited to be a maximum of 128. This means that the
index used to access the arrays must use a test of '< vref_stop_index'
rather than '<= vref_stop_index' in order to prevent out of bounds
accesses to the arrays.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
| -rw-r--r-- | drivers/ram/renesas/dbsc5/dram.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/drivers/ram/renesas/dbsc5/dram.c b/drivers/ram/renesas/dbsc5/dram.c index ca8a7fb4783..3ed02e11f9e 100644 --- a/drivers/ram/renesas/dbsc5/dram.c +++ b/drivers/ram/renesas/dbsc5/dram.c @@ -3735,7 +3735,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev) if (vref_stop_index > 0x80) return 0; - for (i = 0; i <= vref_stop_index; i++) { + for (i = 0; i < vref_stop_index; i++) { r_foreach_vch(dev, ch) { reg = dbsc5_ddr_getval_slice(dev, ch, 0, PHY_PAD_VREF_CTRL_DQ); reg &= 0xF << 10; @@ -3819,7 +3819,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev) best_vref_byte0_index = 0; best_dvw_min_byte0 = dvw_min_byte0_table[ch][0]; - for (i = 0; i <= vref_stop_index; i++) { + for (i = 0; i < vref_stop_index; i++) { if (best_dvw_min_byte0 >= dvw_min_byte0_table[ch][i]) continue; @@ -3858,7 +3858,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev) vref_outlier = dbsc5_ddr_getval_slice(dev, ch, 0, PHY_RDLVL_VREF_OUTLIER); best_upper_vref = best_vref_byte0; outlier_cnt = vref_outlier; - for (i = best_vref_byte0_index; i <= vref_stop_index; i++) { + for (i = best_vref_byte0_index; i < vref_stop_index; i++) { if (dvw_min_byte0_table[ch][i] <= 0) break; @@ -3879,7 +3879,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev) best_vref_byte1 = vref_start; best_vref_byte1_index = 0; best_dvw_min_byte1 = dvw_min_byte1_table[ch][0]; - for (i = 0; i <= vref_stop_index; i++) { + for (i = 0; i < vref_stop_index; i++) { if (best_dvw_min_byte1 >= dvw_min_byte1_table[ch][i]) continue; @@ -3918,7 +3918,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev) vref_outlier = dbsc5_ddr_getval_slice(dev, ch, 1, PHY_RDLVL_VREF_OUTLIER); best_upper_vref = best_vref_byte1; outlier_cnt = vref_outlier; - for (i = best_vref_byte1_index; i <= vref_stop_index; i++) { + for (i = best_vref_byte1_index; i < vref_stop_index; i++) { if (dvw_min_byte1_table[ch][i] <= 0) break; |