msm: ipa3: fix pointer arithmetic to avoid out-of-bound
When offset gets added to base of the array, it returns
offset plus the number equal to size of the whole array.
So, correct it by passing the address of offset element
in the array.
Change-Id: I8a087ca277bdc476674c7221b5fc0920e6986570
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c b/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c
index cf95db4..90a06da 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c
@@ -10293,7 +10293,7 @@
offset = counter->hw_counter.start_id - 1;
if (offset >= 0 && (offset + counter->hw_counter.num_counters)
< IPA_FLT_RT_HW_COUNTER) {
- memset(&ipa3_ctx->flt_rt_counters.used_hw + offset,
+ memset(&ipa3_ctx->flt_rt_counters.used_hw[offset],
0, counter->hw_counter.num_counters * sizeof(bool));
} else {
IPAERR_RL("unexpected hdl %d\n", hdl);
@@ -10302,7 +10302,7 @@
offset = counter->sw_counter.start_id - 1 - IPA_FLT_RT_HW_COUNTER;
if (offset >= 0 && (offset + counter->sw_counter.num_counters)
< IPA_FLT_RT_SW_COUNTER) {
- memset(&ipa3_ctx->flt_rt_counters.used_sw + offset,
+ memset(&ipa3_ctx->flt_rt_counters.used_sw[offset],
0, counter->sw_counter.num_counters * sizeof(bool));
} else {
IPAERR_RL("unexpected hdl %d\n", hdl);