of/selftest: Fix off-by-one error in removal path

commit c1a2086e2d8c4eb4e8630ba752e911ec180dec67 upstream.

The removal path for selftest data has an off by one error that causes
the code to dereference beyond the end of the nodes[] array on the first
pass through. The old code only worked by chance on a lot of platforms,
but the bug was recently exposed on aarch64.

The fix is simple. Decrement the node count before dereferencing, not
after.

Reported-by: Kevin Hilman <khilman@linaro.org>
Cc: Rob Herring <robh+dt@kernel.org>
Cc: Gaurav Minocha <gaurav.minocha.os@gmail.com>

diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c
index c92de69fcf7f47a1f8d847be08986238335d4c31..612a51214a662852c42b3412416d6f45f563e764 100644 (file)
--- a/drivers/of/selftest.c
+++ b/drivers/of/selftest.c
@@ -799,7 +799,7 @@ static void selftest_data_remove(void)
                return;
        }
 
-       while (last_node_index >= 0) {
+       while (last_node_index-- > 0) {
                if (nodes[last_node_index]) {
                        np = of_find_node_by_path(nodes[last_node_index]->full_name);
                        if (strcmp(np->full_name, "/aliases") != 0) {
@@ -812,7 +812,6 @@ static void selftest_data_remove(void)
                                }
                        }
                }
-               last_node_index--;
        }
 }