Skip to content

Commit ea17fc4

Browse files
Xiangxu Yinvinodkoul
authored andcommitted
phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config
swing_tbl and pre_emphasis_tbl are 4x4 arrays (valid indices 0-3), but the boundary check uses "> 4" instead of ">= 4", allowing index 4 to cause an out-of-bounds access. Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Fixes: 81791c4 ("phy: qcom: qmp-usbc: Add QCS615 USB/DP PHY config and DP mode support") Signed-off-by: Xiangxu Yin <xiangxu.yin@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20260227-master-v1-1-8d91b9407fdb@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
1 parent 1854082 commit ea17fc4

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

drivers/phy/qualcomm/phy-qcom-qmp-usbc.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -794,7 +794,7 @@ static int qmp_v2_configure_dp_swing(struct qmp_usbc *qmp)
794794
p_level = max(p_level, dp_opts->pre[i]);
795795
}
796796

797-
if (v_level > 4 || p_level > 4) {
797+
if (v_level >= 4 || p_level >= 4) {
798798
dev_err(qmp->dev, "Invalid v(%d) | p(%d) level)\n",
799799
v_level, p_level);
800800
return -EINVAL;

0 commit comments

Comments
 (0)