ram: renesas: dbsc5: Fix off by 1 errors
authorAndrew Goodbody <andrew.goodbody@linaro.org>
Fri, 8 Aug 2025 11:32:36 +0000 (12:32 +0100)
committerMarek Vasut <marek.vasut+renesas@mailbox.org>
Wed, 20 Aug 2025 21:02:55 +0000 (23:02 +0200)
commitb34b18a2c936c02c42c1c66bee274fcc96e25c57
tree699f654d774d19f0c8f92641f2c6e7215f880923
parent54fbdd408873413af86d86de03a490c5abf280f1
ram: renesas: dbsc5: Fix off by 1 errors

In dbsc5_read_vref_training the arrays dvw_min_byte0_table and
dvw_min_byte1_table have 128 elements per channel. The variable
vref_stop_index is limited to be a maximum of 128. This means that the
index used to access the arrays must use a test of '< vref_stop_index'
rather than '<= vref_stop_index' in order to prevent out of bounds
accesses to the arrays.

This issue was found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
drivers/ram/renesas/dbsc5/dram.c