In rmobile_cpuinfo_idx() there is an off-by-one error in accessing the rmobile_cpuinfo array.

At the end of the loop, i is equal to the array size, i.e. rmobile_cpuinfo[i] accesses one entry past the end of the array. The last entry in the array is a fallback value so the loop should count to ARRAY_SIZE(rmobile_cpuinfo) - 1 instead, this will leave i equal to the index of the fallback value if no match is found.

Signed-off-by: Paul Barker paul.barker.ct@bp.renesas.com Reviewed-by: Biju Das biju.das.jz@bp.renesas.com --- arch/arm/mach-rmobile/cpu_info.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/mach-rmobile/cpu_info.c b/arch/arm/mach-rmobile/cpu_info.c index 1d33e2aa9da3..7651e43bd0fc 100644 --- a/arch/arm/mach-rmobile/cpu_info.c +++ b/arch/arm/mach-rmobile/cpu_info.c @@ -86,7 +86,7 @@ static int rmobile_cpuinfo_idx(void) int i = 0; u32 cpu_type = rmobile_get_cpu_type();

- for (; i < ARRAY_SIZE(rmobile_cpuinfo); i++) + for (; i < ARRAY_SIZE(rmobile_cpuinfo) - 1; i++) if (rmobile_cpuinfo[i].cpu_type == cpu_type) break;