* [PATCH] regulator/lp3971: vol_map out of bounds in lp3971_{ldo,dcdc}_set_voltage()
@ 2010-02-12 11:30 Roel Kluin
2010-02-12 11:32 ` Mark Brown
2010-02-12 11:43 ` Liam Girdwood
0 siblings, 2 replies; 3+ messages in thread
From: Roel Kluin @ 2010-02-12 11:30 UTC (permalink / raw)
To: Liam Girdwood, Mark Brown, Andrew Morton, LKML
After `for (val = LDO_VOL_MIN_IDX; val <= LDO_VOL_MAX_IDX; val++)', if no break
occurs, val reaches LDO_VOL_MIN_IDX + 1, which is out of bounds for
ldo45_voltage_map[] and ldo123_voltage_map[].
Similarly BUCK_TARGET_VOL_MAX_IDX + 1 is out of bounds for buck_voltage_map[].
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/drivers/regulator/lp3971.c b/drivers/regulator/lp3971.c
index 76d08c2..4f33a0f 100644
--- a/drivers/regulator/lp3971.c
+++ b/drivers/regulator/lp3971.c
@@ -183,7 +183,7 @@ static int lp3971_ldo_set_voltage(struct regulator_dev *dev,
if (vol_map[val] >= min_vol)
break;
- if (vol_map[val] > max_vol)
+ if (val > LDO_VOL_MAX_IDX || vol_map[val] > max_vol)
return -EINVAL;
return lp3971_set_bits(lp3971, LP3971_LDO_VOL_CONTR_REG(ldo),
@@ -272,7 +272,7 @@ static int lp3971_dcdc_set_voltage(struct regulator_dev *dev,
if (vol_map[val] >= min_vol)
break;
- if (vol_map[val] > max_vol)
+ if (val > BUCK_TARGET_VOL_MAX_IDX || vol_map[val] > max_vol)
return -EINVAL;
ret = lp3971_set_bits(lp3971, LP3971_BUCK_TARGET_VOL1_REG(buck),
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] regulator/lp3971: vol_map out of bounds in lp3971_{ldo,dcdc}_set_voltage()
2010-02-12 11:30 [PATCH] regulator/lp3971: vol_map out of bounds in lp3971_{ldo,dcdc}_set_voltage() Roel Kluin
@ 2010-02-12 11:32 ` Mark Brown
2010-02-12 11:43 ` Liam Girdwood
1 sibling, 0 replies; 3+ messages in thread
From: Mark Brown @ 2010-02-12 11:32 UTC (permalink / raw)
To: Roel Kluin; +Cc: Liam Girdwood, Andrew Morton, LKML
On Fri, Feb 12, 2010 at 12:30:21PM +0100, Roel Kluin wrote:
> After `for (val = LDO_VOL_MIN_IDX; val <= LDO_VOL_MAX_IDX; val++)', if no break
> occurs, val reaches LDO_VOL_MIN_IDX + 1, which is out of bounds for
> ldo45_voltage_map[] and ldo123_voltage_map[].
>
> Similarly BUCK_TARGET_VOL_MAX_IDX + 1 is out of bounds for buck_voltage_map[].
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] regulator/lp3971: vol_map out of bounds in lp3971_{ldo,dcdc}_set_voltage()
2010-02-12 11:30 [PATCH] regulator/lp3971: vol_map out of bounds in lp3971_{ldo,dcdc}_set_voltage() Roel Kluin
2010-02-12 11:32 ` Mark Brown
@ 2010-02-12 11:43 ` Liam Girdwood
1 sibling, 0 replies; 3+ messages in thread
From: Liam Girdwood @ 2010-02-12 11:43 UTC (permalink / raw)
To: Roel Kluin; +Cc: Mark Brown, Andrew Morton, LKML
On Fri, 2010-02-12 at 12:30 +0100, Roel Kluin wrote:
> After `for (val = LDO_VOL_MIN_IDX; val <= LDO_VOL_MAX_IDX; val++)', if no break
> occurs, val reaches LDO_VOL_MIN_IDX + 1, which is out of bounds for
> ldo45_voltage_map[] and ldo123_voltage_map[].
>
> Similarly BUCK_TARGET_VOL_MAX_IDX + 1 is out of bounds for buck_voltage_map[].
>
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Applied.
Thanks
Liam
--
Freelance Developer, SlimLogic Ltd
ASoC and Voltage Regulator Maintainer.
http://www.slimlogic.co.uk
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-02-12 11:43 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-02-12 11:30 [PATCH] regulator/lp3971: vol_map out of bounds in lp3971_{ldo,dcdc}_set_voltage() Roel Kluin
2010-02-12 11:32 ` Mark Brown
2010-02-12 11:43 ` Liam Girdwood
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox