* [PATCH] PM / OPP: fix off-by-one bug in dev_pm_opp_get_max_volt_latency loop
[not found] <CGME20170220185824eucas1p227fb1d8679f66825702296113c776095@eucas1p2.samsung.com>
@ 2017-02-20 18:57 ` Andrzej Hajda
2017-02-21 3:48 ` Viresh Kumar
0 siblings, 1 reply; 2+ messages in thread
From: Andrzej Hajda @ 2017-02-20 18:57 UTC (permalink / raw)
To: Viresh Kumar, Nishanth Menon, Stephen Boyd, Rafael J. Wysocki,
linux-pm, linux-kernel
Cc: Andrzej Hajda, Bartlomiej Zolnierkiewicz, Marek Szyprowski
Reading array at given index before checking if index is valid results in
illegal memory access.
The bug was detected using KASAN framework.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
---
drivers/base/power/opp/core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c
index 91ec323..dae6172 100644
--- a/drivers/base/power/opp/core.c
+++ b/drivers/base/power/opp/core.c
@@ -231,7 +231,8 @@ unsigned long dev_pm_opp_get_max_volt_latency(struct device *dev)
* The caller needs to ensure that opp_table (and hence the regulator)
* isn't freed, while we are executing this routine.
*/
- for (i = 0; reg = regulators[i], i < count; i++) {
+ for (i = 0; i < count; i++) {
+ reg = regulators[i];
ret = regulator_set_voltage_time(reg, uV[i].min, uV[i].max);
if (ret > 0)
latency_ns += ret * 1000;
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] PM / OPP: fix off-by-one bug in dev_pm_opp_get_max_volt_latency loop
2017-02-20 18:57 ` [PATCH] PM / OPP: fix off-by-one bug in dev_pm_opp_get_max_volt_latency loop Andrzej Hajda
@ 2017-02-21 3:48 ` Viresh Kumar
0 siblings, 0 replies; 2+ messages in thread
From: Viresh Kumar @ 2017-02-21 3:48 UTC (permalink / raw)
To: Andrzej Hajda
Cc: Viresh Kumar, Nishanth Menon, Stephen Boyd, Rafael J. Wysocki,
linux-pm, linux-kernel, Bartlomiej Zolnierkiewicz,
Marek Szyprowski
On 20-02-17, 19:57, Andrzej Hajda wrote:
> Reading array at given index before checking if index is valid results in
> illegal memory access.
>
> The bug was detected using KASAN framework.
>
> Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
> ---
> drivers/base/power/opp/core.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c
> index 91ec323..dae6172 100644
> --- a/drivers/base/power/opp/core.c
> +++ b/drivers/base/power/opp/core.c
> @@ -231,7 +231,8 @@ unsigned long dev_pm_opp_get_max_volt_latency(struct device *dev)
> * The caller needs to ensure that opp_table (and hence the regulator)
> * isn't freed, while we are executing this routine.
> */
> - for (i = 0; reg = regulators[i], i < count; i++) {
> + for (i = 0; i < count; i++) {
> + reg = regulators[i];
> ret = regulator_set_voltage_time(reg, uV[i].min, uV[i].max);
> if (ret > 0)
> latency_ns += ret * 1000;
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
--
viresh
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-02-21 3:48 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <CGME20170220185824eucas1p227fb1d8679f66825702296113c776095@eucas1p2.samsung.com>
2017-02-20 18:57 ` [PATCH] PM / OPP: fix off-by-one bug in dev_pm_opp_get_max_volt_latency loop Andrzej Hajda
2017-02-21 3:48 ` Viresh Kumar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox