From 1a170ff91793881e5ccfde58efcaac1a859c40e0 Mon Sep 17 00:00:00 2001 From: Jagadeesh Ponduru Date: Thu, 30 Mar 2023 13:09:16 +0530 Subject: [PATCH] msm: ipa3: fix pointer arithmetic to avoid out-of-bound When offset gets added to base of the array, it returns offset plus the number equal to size of the whole array. So, correct it by passing the address of offset element in the array. Change-Id: I8a087ca277bdc476674c7221b5fc0920e6986570 --- drivers/platform/msm/ipa/ipa_v3/ipa_utils.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c b/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c index a71731729c37..d29d260e760b 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c @@ -7281,7 +7281,7 @@ void ipa3_counter_remove_hdl(int hdl) offset = counter->hw_counter.start_id - 1; if (offset >= 0 && (offset + counter->hw_counter.num_counters) < IPA_FLT_RT_HW_COUNTER) { - memset(&ipa3_ctx->flt_rt_counters.used_hw + offset, + memset(&ipa3_ctx->flt_rt_counters.used_hw[offset], 0, counter->hw_counter.num_counters * sizeof(bool)); } else { IPAERR_RL("unexpected hdl %d\n", hdl); @@ -7290,7 +7290,7 @@ void ipa3_counter_remove_hdl(int hdl) offset = counter->sw_counter.start_id - 1 - IPA_FLT_RT_HW_COUNTER; if (offset >= 0 && (offset + counter->sw_counter.num_counters) < IPA_FLT_RT_SW_COUNTER) { - memset(&ipa3_ctx->flt_rt_counters.used_sw + offset, + memset(&ipa3_ctx->flt_rt_counters.used_sw[offset], 0, counter->sw_counter.num_counters * sizeof(bool)); } else { IPAERR_RL("unexpected hdl %d\n", hdl);