The function can return a negativ value in case of errors, don't use it blindly as array index.
Detected by CoverityScan CID#1418067 ("Memory - illegal accesses") Fixes: f384b352cbf0 ("mtd: spi-nor: parse Serial Flash Discoverable Parameters (SFDP) tables") Signed-off-by: Richard Weinberger <rich...@nod.at> --- drivers/mtd/spi-nor/spi-nor.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c index cf1d4a15e10a..d71765739a93 100644 --- a/drivers/mtd/spi-nor/spi-nor.c +++ b/drivers/mtd/spi-nor/spi-nor.c @@ -2145,6 +2145,9 @@ static int spi_nor_parse_bfpt(struct spi_nor *nor, params->hwcaps.mask |= rd->hwcaps; cmd = spi_nor_hwcaps_read2cmd(rd->hwcaps); + if (cmd < 0) + return -EINVAL; + read = ¶ms->reads[cmd]; half = bfpt.dwords[rd->settings_dword] >> rd->settings_shift; spi_nor_set_read_settings_from_bfpt(read, half, rd->proto); -- 2.13.5