Author: ian
Date: Thu Jul 5 14:09:48 2018
New Revision: 335982
URL: https://svnweb.freebsd.org/changeset/base/335982
Log:
Fix an out-of-bounds array access... the irq data for teardown is in two
arrays, as elements 0 and 1 of one array and elements 1 and 2 of the other.
Run the loop 0..1 instead of 1..2 and use named constants to offset into
one of the arrays.
PR: 229508
Modified:
head/sys/arm/freescale/imx/imx_gpio.c
Modified: head/sys/arm/freescale/imx/imx_gpio.c
==============================================================================
--- head/sys/arm/freescale/imx/imx_gpio.c Thu Jul 5 13:45:56 2018
(r335981)
+++ head/sys/arm/freescale/imx/imx_gpio.c Thu Jul 5 14:09:48 2018
(r335982)
@@ -134,6 +134,8 @@ static struct resource_spec imx_gpio_spec[] = {
{ SYS_RES_IRQ, 1, RF_ACTIVE },
{ -1, 0 }
};
+#define FIRST_IRQRES 1
+#define NUM_IRQRES 2
/*
* Helpers
@@ -852,9 +854,10 @@ imx51_gpio_detach(device_t dev)
sc = device_get_softc(dev);
gpiobus_detach_bus(dev);
- for (irq = 1; irq <= 2; irq++) {
+ for (irq = 0; irq < NUM_IRQRES; irq++) {
if (sc->gpio_ih[irq])
- bus_teardown_intr(dev, sc->sc_res[irq],
sc->gpio_ih[irq]);
+ bus_teardown_intr(dev, sc->sc_res[irq + FIRST_IRQRES],
+ sc->gpio_ih[irq]);
}
bus_release_resources(dev, imx_gpio_spec, sc->sc_res);
mtx_destroy(&sc->sc_mtx);
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
