mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-16 07:24:39 +08:00
72f039db49
It's possible that struct qmp_phy_cfg->regs references an array that is
smaller than the possible register lookups that is going to be
performed, with the resulting out-of-bounds read resulting in undefined
behavior.
One such example is when during qcom_qmp_phy_com_init() performs a
qphy_setbits() on entry QPHY_PCS_POWER_DOWN_CONTROL (i.e. 17) with
msm8996_ufsphy_regs_layout only being 12 entries long.
Solve this by inflating all "regs_layout" arrays to ensure that any
remaining entries are zero-initialized, as expected by the code.
Fixes:
|
||
---|---|---|
.. | ||
Kconfig | ||
Makefile | ||
phy-ath79-usb.c | ||
phy-qcom-apq8064-sata.c | ||
phy-qcom-ipq806x-sata.c | ||
phy-qcom-ipq4019-usb.c | ||
phy-qcom-pcie2.c | ||
phy-qcom-qmp.c | ||
phy-qcom-qmp.h | ||
phy-qcom-qusb2.c | ||
phy-qcom-snps-femto-v2.c | ||
phy-qcom-ufs-i.h | ||
phy-qcom-ufs-qmp-14nm.c | ||
phy-qcom-ufs-qmp-14nm.h | ||
phy-qcom-ufs-qmp-20nm.c | ||
phy-qcom-ufs-qmp-20nm.h | ||
phy-qcom-ufs.c | ||
phy-qcom-usb-hs-28nm.c | ||
phy-qcom-usb-hs.c | ||
phy-qcom-usb-hsic.c | ||
phy-qcom-usb-ss.c |