From fe8d071c49845c6ad1a387762f048ef158326580 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 1 Sep 2025 18:00:12 +0100 Subject: [PATCH] pwm: cadence-ttc: Insufficient elements in array The Cadence TTC has 3 channels that can each be used for PWM functions. Ensure that the array has sufficient elements to avoid a possible memory access overrun. Use a macro to keep the array size and limit checks in sync so adjust checks to work with this. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Link: https://lore.kernel.org/r/20250901-cadence_pwm-v1-1-140b04cd73a9@linaro.org Signed-off-by: Michal Simek --- drivers/pwm/pwm-cadence-ttc.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/pwm/pwm-cadence-ttc.c b/drivers/pwm/pwm-cadence-ttc.c index 767628833bc..fae6d5a1739 100644 --- a/drivers/pwm/pwm-cadence-ttc.c +++ b/drivers/pwm/pwm-cadence-ttc.c @@ -47,6 +47,8 @@ #define TTC_MATCH_1_COUNTER(reg, channel) \ TTC_REG((reg) + MATCH_1_COUNTER, (channel)) +#define TTC_PWM_CHANNELS 3 + struct cadence_ttc_pwm_plat { u8 *regs; u32 timer_width; @@ -57,7 +59,7 @@ struct cadence_ttc_pwm_priv { u32 timer_width; u32 timer_mask; unsigned long frequency; - bool invert[2]; + bool invert[TTC_PWM_CHANNELS]; }; static int cadence_ttc_pwm_set_invert(struct udevice *dev, uint channel, @@ -65,7 +67,7 @@ static int cadence_ttc_pwm_set_invert(struct udevice *dev, uint channel, { struct cadence_ttc_pwm_priv *priv = dev_get_priv(dev); - if (channel > 2) { + if (channel >= TTC_PWM_CHANNELS) { dev_err(dev, "Unsupported channel number %d(max 2)\n", channel); return -EINVAL; } @@ -87,7 +89,7 @@ static int cadence_ttc_pwm_set_config(struct udevice *dev, uint channel, dev_dbg(dev, "channel %d, duty %d/period %d ns\n", channel, duty_ns, period_ns); - if (channel > 2) { + if (channel >= TTC_PWM_CHANNELS) { dev_err(dev, "Unsupported channel number %d(max 2)\n", channel); return -EINVAL; } @@ -153,7 +155,7 @@ static int cadence_ttc_pwm_set_enable(struct udevice *dev, uint channel, { struct cadence_ttc_pwm_priv *priv = dev_get_priv(dev); - if (channel > 2) { + if (channel >= TTC_PWM_CHANNELS) { dev_err(dev, "Unsupported channel number %d(max 2)\n", channel); return -EINVAL; } -- 2.47.3