diff mbox series

[SRU,Mantic,1/1] pwm: Fix out-of-bounds access in of_pwm_single_xlate()

Message ID 20240304203718.25418-2-bethany.jamison@canonical.com
State New
Headers show
Series CVE-2024-26599 | expand

Commit Message

Bethany Jamison March 4, 2024, 8:37 p.m. UTC 
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

With args->args_count == 2 args->args[2] is not defined. Actually the
flags are contained in args->args[1].

Fixes: 3ab7b6ac5d82 ("pwm: Introduce single-PWM of_xlate function")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/243908750d306e018a3d4bf2eb745d53ab50f663.1704835845.git.u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
(cherry picked from commit a297d07b9a1e4fb8cda25a4a2363a507d294b7c9)
CVE-2024-26599
Signed-off-by: Bethany Jamison <bethany.jamison@canonical.com>
---
 drivers/pwm/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
index 3dacceaef4a9b..8bd72d1148251 100644
--- a/drivers/pwm/core.c
+++ b/drivers/pwm/core.c
@@ -176,7 +176,7 @@  of_pwm_single_xlate(struct pwm_chip *pc, const struct of_phandle_args *args)
 	pwm->args.period = args->args[0];
 	pwm->args.polarity = PWM_POLARITY_NORMAL;
 
-	if (args->args_count == 2 && args->args[2] & PWM_POLARITY_INVERTED)
+	if (args->args_count == 2 && args->args[1] & PWM_POLARITY_INVERTED)
 		pwm->args.polarity = PWM_POLARITY_INVERSED;
 
 	return pwm;