mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2025-12-20 08:52:12 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

ram: renesas: dbsc5: Fix off by 1 errors

Browse Source 
In dbsc5_read_vref_training the arrays dvw_min_byte0_table and
dvw_min_byte1_table have 128 elements per channel. The variable
vref_stop_index is limited to be a maximum of 128. This means that the
index used to access the arrays must use a test of '< vref_stop_index'
rather than '<= vref_stop_index' in order to prevent out of bounds
accesses to the arrays.

This issue was found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
This commit is contained in:
Andrew Goodbody 2025-08-08 12:32:36 +01:00 committed by Marek Vasut
parent 54fbdd4088
commit b34b18a2c9
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/ram/renesas/dbsc5/dram.c
View File

@ -3735,7 +3735,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev)
if (vref_stop_index > 0x80) if (vref_stop_index > 0x80)
return 0; return 0;
for (i = 0; i <= vref_stop_index; i++) { for (i = 0; i < vref_stop_index; i++) {
r_foreach_vch(dev, ch) { r_foreach_vch(dev, ch) {
reg = dbsc5_ddr_getval_slice(dev, ch, 0, PHY_PAD_VREF_CTRL_DQ); reg = dbsc5_ddr_getval_slice(dev, ch, 0, PHY_PAD_VREF_CTRL_DQ);
reg &= 0xF << 10; reg &= 0xF << 10;
@ -3819,7 +3819,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev)
best_vref_byte0_index = 0; best_vref_byte0_index = 0;
best_dvw_min_byte0 = dvw_min_byte0_table[ch][0]; best_dvw_min_byte0 = dvw_min_byte0_table[ch][0];
for (i = 0; i <= vref_stop_index; i++) { for (i = 0; i < vref_stop_index; i++) {
if (best_dvw_min_byte0 >= dvw_min_byte0_table[ch][i]) if (best_dvw_min_byte0 >= dvw_min_byte0_table[ch][i])
continue; continue;
@ -3858,7 +3858,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev)
vref_outlier = dbsc5_ddr_getval_slice(dev, ch, 0, PHY_RDLVL_VREF_OUTLIER); vref_outlier = dbsc5_ddr_getval_slice(dev, ch, 0, PHY_RDLVL_VREF_OUTLIER);
best_upper_vref = best_vref_byte0; best_upper_vref = best_vref_byte0;
outlier_cnt = vref_outlier; outlier_cnt = vref_outlier;
for (i = best_vref_byte0_index; i <= vref_stop_index; i++) { for (i = best_vref_byte0_index; i < vref_stop_index; i++) {
if (dvw_min_byte0_table[ch][i] <= 0) if (dvw_min_byte0_table[ch][i] <= 0)
break; break;
@ -3879,7 +3879,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev)
best_vref_byte1 = vref_start; best_vref_byte1 = vref_start;
best_vref_byte1_index = 0; best_vref_byte1_index = 0;
best_dvw_min_byte1 = dvw_min_byte1_table[ch][0]; best_dvw_min_byte1 = dvw_min_byte1_table[ch][0];
for (i = 0; i <= vref_stop_index; i++) { for (i = 0; i < vref_stop_index; i++) {
if (best_dvw_min_byte1 >= dvw_min_byte1_table[ch][i]) if (best_dvw_min_byte1 >= dvw_min_byte1_table[ch][i])
continue; continue;
@ -3918,7 +3918,7 @@ static u32 dbsc5_read_vref_training(struct udevice *dev)
vref_outlier = dbsc5_ddr_getval_slice(dev, ch, 1, PHY_RDLVL_VREF_OUTLIER); vref_outlier = dbsc5_ddr_getval_slice(dev, ch, 1, PHY_RDLVL_VREF_OUTLIER);
best_upper_vref = best_vref_byte1; best_upper_vref = best_vref_byte1;
outlier_cnt = vref_outlier; outlier_cnt = vref_outlier;
for (i = best_vref_byte1_index; i <= vref_stop_index; i++) { for (i = best_vref_byte1_index; i < vref_stop_index; i++) {
if (dvw_min_byte1_table[ch][i] <= 0) if (dvw_min_byte1_table[ch][i] <= 0)
break; break;