* [PATCH] PM / OPP: fix off-by-one bug in dev_pm_opp_get_max_volt_latency loop [not found] <CGME20170220185824eucas1p227fb1d8679f66825702296113c776095@eucas1p2.samsung.com> @ 2017-02-20 18:57 ` Andrzej Hajda 2017-02-21 3:48 ` Viresh Kumar 0 siblings, 1 reply; 2+ messages in thread From: Andrzej Hajda @ 2017-02-20 18:57 UTC (permalink / raw) To: Viresh Kumar, Nishanth Menon, Stephen Boyd, Rafael J. Wysocki, linux-pm, linux-kernel Cc: Andrzej Hajda, Bartlomiej Zolnierkiewicz, Marek Szyprowski Reading array at given index before checking if index is valid results in illegal memory access. The bug was detected using KASAN framework. Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> --- drivers/base/power/opp/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c index 91ec323..dae6172 100644 --- a/drivers/base/power/opp/core.c +++ b/drivers/base/power/opp/core.c @@ -231,7 +231,8 @@ unsigned long dev_pm_opp_get_max_volt_latency(struct device *dev) * The caller needs to ensure that opp_table (and hence the regulator) * isn't freed, while we are executing this routine. */ - for (i = 0; reg = regulators[i], i < count; i++) { + for (i = 0; i < count; i++) { + reg = regulators[i]; ret = regulator_set_voltage_time(reg, uV[i].min, uV[i].max); if (ret > 0) latency_ns += ret * 1000; -- 2.7.4 ^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] PM / OPP: fix off-by-one bug in dev_pm_opp_get_max_volt_latency loop 2017-02-20 18:57 ` [PATCH] PM / OPP: fix off-by-one bug in dev_pm_opp_get_max_volt_latency loop Andrzej Hajda @ 2017-02-21 3:48 ` Viresh Kumar 0 siblings, 0 replies; 2+ messages in thread From: Viresh Kumar @ 2017-02-21 3:48 UTC (permalink / raw) To: Andrzej Hajda Cc: Viresh Kumar, Nishanth Menon, Stephen Boyd, Rafael J. Wysocki, linux-pm, linux-kernel, Bartlomiej Zolnierkiewicz, Marek Szyprowski On 20-02-17, 19:57, Andrzej Hajda wrote: > Reading array at given index before checking if index is valid results in > illegal memory access. > > The bug was detected using KASAN framework. > > Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> > --- > drivers/base/power/opp/core.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c > index 91ec323..dae6172 100644 > --- a/drivers/base/power/opp/core.c > +++ b/drivers/base/power/opp/core.c > @@ -231,7 +231,8 @@ unsigned long dev_pm_opp_get_max_volt_latency(struct device *dev) > * The caller needs to ensure that opp_table (and hence the regulator) > * isn't freed, while we are executing this routine. > */ > - for (i = 0; reg = regulators[i], i < count; i++) { > + for (i = 0; i < count; i++) { > + reg = regulators[i]; > ret = regulator_set_voltage_time(reg, uV[i].min, uV[i].max); > if (ret > 0) > latency_ns += ret * 1000; Acked-by: Viresh Kumar <viresh.kumar@linaro.org> -- viresh ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-02-21 3:48 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <CGME20170220185824eucas1p227fb1d8679f66825702296113c776095@eucas1p2.samsung.com>
2017-02-20 18:57 ` [PATCH] PM / OPP: fix off-by-one bug in dev_pm_opp_get_max_volt_latency loop Andrzej Hajda
2017-02-21 3:48 ` Viresh Kumar
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox