Re: [PATCH next] pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group()

[Kunwu Chan]

On 2025/3/19 15:05, Dan Carpenter wrote:
> This should be >= pmx->soc->ngroups instead of > to avoid an out of
> bounds access.  The pmx->soc->groups[] array is allocated in
> tegra_pinctrl_probe().
>
> Fixes: c12bfa0fee65 ("pinctrl-tegra: Restore SFSEL bit when freeing pins")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> ---
>   drivers/pinctrl/tegra/pinctrl-tegra.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/pinctrl/tegra/pinctrl-tegra.c b/drivers/pinctrl/tegra/pinctrl-tegra.c
> index 0246acba7703..11ecbd6a9b2a 100644
> --- a/drivers/pinctrl/tegra/pinctrl-tegra.c
> +++ b/drivers/pinctrl/tegra/pinctrl-tegra.c
> @@ -306,7 +306,7 @@ static const struct tegra_pingroup *tegra_pinctrl_get_group(struct pinctrl_dev *
>   {
>   	struct tegra_pmx *pmx = pinctrl_dev_get_drvdata(pctldev);
>   
> -	if (group_index < 0 || group_index > pmx->soc->ngroups)
> +	if (group_index < 0 || group_index >= pmx->soc->ngroups)
>   		return NULL;
>   
>   	return &pmx->soc->groups[group_index];

Reviewed-by: Kunwu Chan <kunwu.chan@xxxxxxxxx>

--
Thanks,
  Kunwu.Chan(Tao.Chan)