All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mark Brown <broonie@opensource.wolfsonmicro.com>
To: Axel Lin <axel.lin@gmail.com>
Cc: linux-kernel@vger.kernel.org, Graeme Gregory <gg@slimlogic.co.uk>,
	Jorge Eduardo Candelaria <jedu@slimlogic.co.uk>,
	Liam Girdwood <lrg@ti.com>
Subject: Re: [PATCH] regulator: tps65910: Fix array access out of bounds bug
Date: Mon, 11 Jul 2011 12:48:42 +0900	[thread overview]
Message-ID: <20110711034840.GA4532@opensource.wolfsonmicro.com> (raw)
In-Reply-To: <1310349463.2316.4.camel@phoenix>

On Mon, Jul 11, 2011 at 09:57:43AM +0800, Axel Lin wrote:
> For tps65910, the number of regulator is 13. ( ARRAY_SIZE(tps65910_regs) is 13)
> For tps65911, the number of regulator is 12. ( ARRAY_SIZE(tps65911_regs) is 12)
> If we are using this driver for tps65911,
> we hit array access out of bounds bug in tps65910_probe() because
> current implementation always assume the number of regulator is 13 and
> thus it will access tps65911_regs[12].
> 
> Fix it by setting correct num_regulators for both chips in tps65910_probe(),
> and allocated neccessay memory accordingly.

Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>

This patch would be much less invasive if you didn't change to
allocating everything dynamically - you could fix the out of bounds
issues by just limiting the number of times we go round the array.

  reply	other threads:[~2011-07-11  3:48 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-07-11  1:57 [PATCH] regulator: tps65910: Fix array access out of bounds bug Axel Lin
2011-07-11  3:48 ` Mark Brown [this message]
2011-07-22 10:47 ` Liam Girdwood

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20110711034840.GA4532@opensource.wolfsonmicro.com \
    --to=broonie@opensource.wolfsonmicro.com \
    --cc=axel.lin@gmail.com \
    --cc=gg@slimlogic.co.uk \
    --cc=jedu@slimlogic.co.uk \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lrg@ti.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.