ram: renesas: dbsc5: Fix off by 1 errors

In dbsc5_read_vref_training the arrays dvw_min_byte0_table and
dvw_min_byte1_table have 128 elements per channel. The variable
vref_stop_index is limited to be a maximum of 128. This means that the
index used to access the arrays must use a test of '< vref_stop_index'
rather than '<= vref_stop_index' in order to prevent out of bounds
accesses to the arrays.

This issue was found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org>

diff --git a/drivers/ram/renesas/dbsc5/dram.c b/drivers/ram/renesas/dbsc5/dram.c
index ca8a7fb..3ed02e1 100644 (file)
--- a/drivers/ram/renesas/dbsc5/dram.c
+++ b/drivers/ram/renesas/dbsc5/dram.c
@@ -3735,7 +3735,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev)
        if (vref_stop_index > 0x80)
                return 0;
 
-       for (i = 0; i <= vref_stop_index; i++) {
+       for (i = 0; i < vref_stop_index; i++) {
                r_foreach_vch(dev, ch) {
                        reg = dbsc5_ddr_getval_slice(dev, ch, 0, PHY_PAD_VREF_CTRL_DQ);
                        reg &= 0xF << 10;
@@ -3819,7 +3819,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev)
                best_vref_byte0_index = 0;
                best_dvw_min_byte0 = dvw_min_byte0_table[ch][0];
 
-               for (i = 0; i <= vref_stop_index; i++) {
+               for (i = 0; i < vref_stop_index; i++) {
                        if (best_dvw_min_byte0 >= dvw_min_byte0_table[ch][i])
                                continue;
 
@@ -3858,7 +3858,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev)
                vref_outlier = dbsc5_ddr_getval_slice(dev, ch, 0, PHY_RDLVL_VREF_OUTLIER);
                best_upper_vref = best_vref_byte0;
                outlier_cnt = vref_outlier;
-               for (i = best_vref_byte0_index; i <= vref_stop_index; i++) {
+               for (i = best_vref_byte0_index; i < vref_stop_index; i++) {
                        if (dvw_min_byte0_table[ch][i] <= 0)
                                break;
 
@@ -3879,7 +3879,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev)
                best_vref_byte1 = vref_start;
                best_vref_byte1_index = 0;
                best_dvw_min_byte1 = dvw_min_byte1_table[ch][0];
-               for (i = 0; i <= vref_stop_index; i++) {
+               for (i = 0; i < vref_stop_index; i++) {
                        if (best_dvw_min_byte1 >= dvw_min_byte1_table[ch][i])
                                continue;
 
@@ -3918,7 +3918,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev)
                vref_outlier = dbsc5_ddr_getval_slice(dev, ch, 1, PHY_RDLVL_VREF_OUTLIER);
                best_upper_vref = best_vref_byte1;
                outlier_cnt = vref_outlier;
-               for (i = best_vref_byte1_index; i <= vref_stop_index; i++) {
+               for (i = best_vref_byte1_index; i < vref_stop_index; i++) {
                        if (dvw_min_byte1_table[ch][i] <= 0)
                                break;