spmi: Fix sandbox spmi driver memory corruption

There is off-by-one error in sandbox_emul_gpio that causes
segfault of certain tests.

EMUL_GPIO_REG_END is the address of last valid (emulated) register.
This patch fixed this (by adding one more element to emulated register array).

Signed-off-by: Mateusz Kulikowski <[email protected]>
Tested-by: Stephen Warren <[email protected]>

diff --git a/drivers/spmi/spmi-sandbox.c b/drivers/spmi/spmi-sandbox.c
index 2f0fea07e8012f30171ac9d22a7b243702a8672b..980aff2063a5308dc89647865caa7d0fd3dbbf4a 100644 (file)
--- a/drivers/spmi/spmi-sandbox.c
+++ b/drivers/spmi/spmi-sandbox.c
@@ -35,7 +35,8 @@ struct sandbox_emul_fake_regs {
 };
 
 struct sandbox_emul_gpio {
-       struct sandbox_emul_fake_regs r[EMUL_GPIO_REG_END]; /* Fake registers */
+       /* Fake registers - need one more entry as REG_END is valid address. */
+       struct sandbox_emul_fake_regs r[EMUL_GPIO_REG_END + 1];
 };
 
 struct sandbox_spmi_priv {