The use of the unsigned variable 'i' as a loop index leads to the test
for i being non-negative always being true. Instead declare 'i' as an
int so that the for loop will terminate as expected.
If the original for loop completes 'i' will be 1 past the end of the
array so decrement it in the subsequent error path to prevent an out of
bounds access occurring.

This issue was found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodb...@linaro.org>
---
 drivers/clk/at91/sckc.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/clk/at91/sckc.c b/drivers/clk/at91/sckc.c
index 6d6f12578db..3fde8ea7138 100644
--- a/drivers/clk/at91/sckc.c
+++ b/drivers/clk/at91/sckc.c
@@ -74,8 +74,8 @@ static struct clk *at91_sam9x60_clk_register_td_slck(struct 
sam9x60_sckc *sckc,
                int num_parents)
 {
        struct clk *clk;
-       int ret = -ENOMEM;
-       u32 val, i;
+       int ret = -ENOMEM, i;
+       u32 val;
 
        if (!sckc || !name || !parent_names || num_parents != 2)
                return ERR_PTR(-EINVAL);
@@ -99,8 +99,10 @@ static struct clk *at91_sam9x60_clk_register_td_slck(struct 
sam9x60_sckc *sckc,
        clk = &sckc->clk;
        ret = clk_register(clk, UBOOT_DM_CLK_AT91_SAM9X60_TD_SLCK, name,
                           parent_names[val]);
-       if (ret)
+       if (ret) {
+               i--;
                goto free;
+       }
 
        return clk;
 

-- 
2.39.5

Reply via email to