From: Grant Likely <grant.likely@linaro.org>
Date: Wed, 19 Nov 2014 16:22:32 +0000 (+0000)
Subject: of/selftest: Fix off-by-one error in removal path
X-Git-Tag: v3.17.5~47
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1f8d238e13cd3bdc43b1c2623755347a24f4ce7e;p=thirdparty%2Fkernel%2Fstable.git

of/selftest: Fix off-by-one error in removal path

commit c1a2086e2d8c4eb4e8630ba752e911ec180dec67 upstream.

The removal path for selftest data has an off by one error that causes
the code to dereference beyond the end of the nodes[] array on the first
pass through. The old code only worked by chance on a lot of platforms,
but the bug was recently exposed on aarch64.

The fix is simple. Decrement the node count before dereferencing, not
after.

Reported-by: Kevin Hilman <khilman@linaro.org>
Cc: Rob Herring <robh+dt@kernel.org>
Cc: Gaurav Minocha <gaurav.minocha.os@gmail.com>
---

diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c
index c92de69fcf7f4..612a51214a662 100644
--- a/drivers/of/selftest.c
+++ b/drivers/of/selftest.c
@@ -799,7 +799,7 @@ static void selftest_data_remove(void)
 		return;
 	}
 
-	while (last_node_index >= 0) {
+	while (last_node_index-- > 0) {
 		if (nodes[last_node_index]) {
 			np = of_find_node_by_path(nodes[last_node_index]->full_name);
 			if (strcmp(np->full_name, "/aliases") != 0) {
@@ -812,7 +812,6 @@ static void selftest_data_remove(void)
 				}
 			}
 		}
-		last_node_index--;
 	}
 }