[PATCH] regmap: irq: fix incorrect index calculation for read_sub_irq_data()

[PATCH] regmap: irq: fix incorrect index calculation for read_sub_irq_data()

[Qinguang Xu via B4 Relay]

From: Qinguang Xu <guang.cy2023@gmail.com>

While working on a PMIC driver that utilizes num_main_regs > 1, this
issue was noticed. Currently, no in-tree driver sets `num_main_regs >
1`, so this bug has not been triggered in practice.

Pass the global index calculated with `i` instead of the local bit
offset `b` to read_sub_irq_data().

Fix an off-by-one error in the index bounds check.

This patch has been compile-tested only.

Signed-off-by: Qinguang Xu <guang.cy2023@gmail.com>
---
 drivers/base/regmap/regmap-irq.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 99b55b105..e151c6222 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -398,14 +398,14 @@ static int read_irq_data(struct regmap_irq_chip_data *data)
 
 		/* Read sub registers with active IRQs */
 		for (i = 0; i < chip->num_main_regs; i++) {
-			unsigned int b;
+			unsigned int b, index;
 			const unsigned long mreg = data->main_status_buf[i];
 
 			for_each_set_bit(b, &mreg, map->format.val_bytes * 8) {
-				if (i * map->format.val_bytes * 8 + b >
-				    max_main_bits)
+				index = i * map->format.val_bytes * 8 + b;
+				if (index >= max_main_bits)
 					break;
-				ret = read_sub_irq_data(data, b);
+				ret = read_sub_irq_data(data, index);
 
 				if (ret != 0) {
 					dev_err(map->dev, "Failed to read IRQ status %d\n", ret);

---
base-commit: 4056b3c9d3c92ea45955641dbafeb9b960e146ef
change-id: 20261020-debug-6bee55638a91

Best regards,
-- 
Qinguang Xu <guang.cy2023@gmail.com>

[PATCH] regmap: irq: fix incorrect index calculation for read_sub_irq_data()

[Qinguang Xu]

While working on a PMIC driver that utilizes num_main_regs > 1, this
issue was noticed. Currently, no in-tree driver sets `num_main_regs >
1`, so this bug has not been triggered in practice.

Pass the global index calculated with `i` instead of the local bit
offset `b` to read_sub_irq_data().

Fix an off-by-one error in the index bounds check.

This patch has been compile-tested only.

Signed-off-by: Qinguang Xu <guang.cy2023@gmail.com>
---
 drivers/base/regmap/regmap-irq.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 99b55b105..e151c6222 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -398,14 +398,14 @@ static int read_irq_data(struct regmap_irq_chip_data *data)
 
 		/* Read sub registers with active IRQs */
 		for (i = 0; i < chip->num_main_regs; i++) {
-			unsigned int b;
+			unsigned int b, index;
 			const unsigned long mreg = data->main_status_buf[i];
 
 			for_each_set_bit(b, &mreg, map->format.val_bytes * 8) {
-				if (i * map->format.val_bytes * 8 + b >
-				    max_main_bits)
+				index = i * map->format.val_bytes * 8 + b;
+				if (index >= max_main_bits)
 					break;
-				ret = read_sub_irq_data(data, b);
+				ret = read_sub_irq_data(data, index);
 
 				if (ret != 0) {
 					dev_err(map->dev, "Failed to read IRQ status %d\n", ret);

---
base-commit: 4056b3c9d3c92ea45955641dbafeb9b960e146ef
change-id: 20261020-debug-6bee55638a91

Best regards,
-- 
Qinguang Xu <guang.cy2023@gmail.com>