Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

thunderbolt: Fix off by one in tb_port_find_retimer()

This array uses 1-based indexing so it corrupts memory one element
beyond of the array. Fix it by making the array one element larger.

Fixes: dacb12877d92 ("thunderbolt: Add support for on-board retimers")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>

authored by

Dan Carpenter and committed by
Mika Westerberg
08fe7ae1 bec4d7c9

+1 -1
+1 -1
drivers/thunderbolt/retimer.c
··· 406 406 */ 407 407 int tb_retimer_scan(struct tb_port *port) 408 408 { 409 - u32 status[TB_MAX_RETIMER_INDEX] = {}; 409 + u32 status[TB_MAX_RETIMER_INDEX + 1] = {}; 410 410 int ret, i, last_idx = 0; 411 411 412 412 if (!port->cap_usb4)