pwm: Fix out-of-bounds access in of_pwm_single_xlate()

commit a297d07b9a1e4fb8cda25a4a2363a507d294b7c9 upstream.

With args->args_count == 2 args->args[2] is not defined. Actually the
flags are contained in args->args[1].

Fixes: 3ab7b6ac5d82 ("pwm: Introduce single-PWM of_xlate function")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/243908750d306e018a3d4bf2eb745d53ab50f663.1704835845.git.u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
index dc66e34..0c8c632 100644 (file)
--- a/drivers/pwm/core.c
+++ b/drivers/pwm/core.c
@@ -176,7 +176,7 @@ of_pwm_single_xlate(struct pwm_chip *chip, const struct of_phandle_args *args)
        pwm->args.period = args->args[0];
        pwm->args.polarity = PWM_POLARITY_NORMAL;
 
-       if (args->args_count == 2 && args->args[2] & PWM_POLARITY_INVERTED)
+       if (args->args_count == 2 && args->args[1] & PWM_POLARITY_INVERTED)
                pwm->args.polarity = PWM_POLARITY_INVERSED;
 
        return pwm;