mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop

[ Upstream commit 0aead8197fc1a85b0a89646e418feb49a564b029 ]

The cleanup loop was starting at the wrong array index, causing
out-of-bounds access.
Start the loop at the correct index for zero-indexed arrays to prevent
accessing memory beyond the allocated array bounds.

Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
Signed-off-by: Harini T <harini.t@amd.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
index 411bbc10edeaf4932c5f7396cd9f614e29b9da88..fab897b5724c1c7ddbaa2f4d8b4b2c28238e4193 100644 (file)
--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
+++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
@@ -890,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
        if (pdata->irq < MAX_SGI)
                xlnx_mbox_cleanup_sgi(pdata);
 
-       i = pdata->num_mboxes;
+       i = pdata->num_mboxes - 1;
        for (; i >= 0; i--) {
                ipi_mbox = &pdata->ipi_mboxes[i];
                if (device_is_registered(&ipi_mbox->dev))