From: Roel Kluin <roel.kluin@gmail.com>
To: Liam Girdwood <lrg@slimlogic.co.uk>,
Mark Brown <broonie@opensource.wolfsonmicro.com>,
Andrew Morton <akpm@linux-foundation.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: [PATCH] regulator/lp3971: vol_map out of bounds in lp3971_{ldo,dcdc}_set_voltage()
Date: Fri, 12 Feb 2010 12:30:21 +0100 [thread overview]
Message-ID: <4B753BCD.8060100@gmail.com> (raw)
After `for (val = LDO_VOL_MIN_IDX; val <= LDO_VOL_MAX_IDX; val++)', if no break
occurs, val reaches LDO_VOL_MIN_IDX + 1, which is out of bounds for
ldo45_voltage_map[] and ldo123_voltage_map[].
Similarly BUCK_TARGET_VOL_MAX_IDX + 1 is out of bounds for buck_voltage_map[].
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/drivers/regulator/lp3971.c b/drivers/regulator/lp3971.c
index 76d08c2..4f33a0f 100644
--- a/drivers/regulator/lp3971.c
+++ b/drivers/regulator/lp3971.c
@@ -183,7 +183,7 @@ static int lp3971_ldo_set_voltage(struct regulator_dev *dev,
if (vol_map[val] >= min_vol)
break;
- if (vol_map[val] > max_vol)
+ if (val > LDO_VOL_MAX_IDX || vol_map[val] > max_vol)
return -EINVAL;
return lp3971_set_bits(lp3971, LP3971_LDO_VOL_CONTR_REG(ldo),
@@ -272,7 +272,7 @@ static int lp3971_dcdc_set_voltage(struct regulator_dev *dev,
if (vol_map[val] >= min_vol)
break;
- if (vol_map[val] > max_vol)
+ if (val > BUCK_TARGET_VOL_MAX_IDX || vol_map[val] > max_vol)
return -EINVAL;
ret = lp3971_set_bits(lp3971, LP3971_BUCK_TARGET_VOL1_REG(buck),
next reply other threads:[~2010-02-12 11:23 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-02-12 11:30 Roel Kluin [this message]
2010-02-12 11:32 ` [PATCH] regulator/lp3971: vol_map out of bounds in lp3971_{ldo,dcdc}_set_voltage() Mark Brown
2010-02-12 11:43 ` Liam Girdwood
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4B753BCD.8060100@gmail.com \
--to=roel.kluin@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=broonie@opensource.wolfsonmicro.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lrg@slimlogic.co.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.