svn commit: r335982 - head/sys/arm/freescale/imx

[Ian Lepore]

Author: ian
Date: Thu Jul  5 14:09:48 2018
New Revision: 335982
URL: https://svnweb.freebsd.org/changeset/base/335982

Log:
  Fix an out-of-bounds array access... the irq data for teardown is in two
  arrays, as elements 0 and 1 of one array and elements 1 and 2 of the other.
  Run the loop 0..1 instead of 1..2 and use named constants to offset into
  one of the arrays.
  
  PR:		229508

Modified:
  head/sys/arm/freescale/imx/imx_gpio.c

Modified: head/sys/arm/freescale/imx/imx_gpio.c
==============================================================================
--- head/sys/arm/freescale/imx/imx_gpio.c	Thu Jul  5 13:45:56 2018	(r335981)
+++ head/sys/arm/freescale/imx/imx_gpio.c	Thu Jul  5 14:09:48 2018	(r335982)
@@ -134,6 +134,8 @@ static struct resource_spec imx_gpio_spec[] = {
 	{ SYS_RES_IRQ,		1,	RF_ACTIVE },
 	{ -1, 0 }
 };
+#define	FIRST_IRQRES	1
+#define	NUM_IRQRES	2
 
 /*
  * Helpers
@@ -852,9 +854,10 @@ imx51_gpio_detach(device_t dev)
 	sc = device_get_softc(dev);
 
 	gpiobus_detach_bus(dev);
-	for (irq = 1; irq <= 2; irq++) {
+	for (irq = 0; irq < NUM_IRQRES; irq++) {
 		if (sc->gpio_ih[irq])
-			bus_teardown_intr(dev, sc->sc_res[irq], sc->gpio_ih[irq]);
+			bus_teardown_intr(dev, sc->sc_res[irq + FIRST_IRQRES],
+			    sc->gpio_ih[irq]);
 	}
 	bus_release_resources(dev, imx_gpio_spec, sc->sc_res);
 	mtx_destroy(&sc->sc_mtx);