platform/x86: dasharo-acpi: Fix a couple off by one bugs

[PATCH next] platform/x86: dasharo-acpi: Fix a couple off by one bugs

Posted by Dan Carpenter 7 months, 1 week ago

These two > comparisons should be >= to prevent reading beyond
the end of the array.

Fixes: 2dd40523b7e2 ("platform/x86: Introduce dasharo-acpi platform driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
 drivers/platform/x86/dasharo-acpi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/x86/dasharo-acpi.c b/drivers/platform/x86/dasharo-acpi.c
index f10f52e44641..f0c5136af29d 100644
--- a/drivers/platform/x86/dasharo-acpi.c
+++ b/drivers/platform/x86/dasharo-acpi.c
@@ -101,10 +101,10 @@ static int dasharo_read_channel(struct dasharo_data *data, char *method, enum da
 	acpi_status status;
 	u64 val;
 
-	if (feat > ARRAY_SIZE(data->capabilities))
+	if (feat >= ARRAY_SIZE(data->capabilities))
 		return -EINVAL;
 
-	if (channel > data->caps_found[feat])
+	if (channel >= data->caps_found[feat])
 		return -EINVAL;
 
 	obj[0].type = ACPI_TYPE_INTEGER;
-- 
2.47.2

Re: [PATCH next] platform/x86: dasharo-acpi: Fix a couple off by one bugs

Posted by Ilpo Järvinen 7 months, 1 week ago

On Wed, 7 May 2025, Dan Carpenter wrote:

> These two > comparisons should be >= to prevent reading beyond
> the end of the array.
> 
> Fixes: 2dd40523b7e2 ("platform/x86: Introduce dasharo-acpi platform driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
>  drivers/platform/x86/dasharo-acpi.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/platform/x86/dasharo-acpi.c b/drivers/platform/x86/dasharo-acpi.c
> index f10f52e44641..f0c5136af29d 100644
> --- a/drivers/platform/x86/dasharo-acpi.c
> +++ b/drivers/platform/x86/dasharo-acpi.c
> @@ -101,10 +101,10 @@ static int dasharo_read_channel(struct dasharo_data *data, char *method, enum da
>  	acpi_status status;
>  	u64 val;
>  
> -	if (feat > ARRAY_SIZE(data->capabilities))
> +	if (feat >= ARRAY_SIZE(data->capabilities))
>  		return -EINVAL;
>  
> -	if (channel > data->caps_found[feat])
> +	if (channel >= data->caps_found[feat])
>  		return -EINVAL;
>  
>  	obj[0].type = ACPI_TYPE_INTEGER;
> 

Thanks Dan, I've folded this into the original commit as I was rewriting 
history anyway due to some other fixes.

-- 
 i.