[PATCH] regulator: 88pm8607 - fix value range checking for accessing info->vol_table

[PATCH] regulator: 88pm8607 - fix value range checking for accessing info->vol_table

[Axel Lin]

In choose_voltage(), we use i as array index of info->vol_table.
The valid value range for i should be 0 .. ARRAY_SIZE(info->vol_table) - 1.

Take LDO1 as example, ARRAY_SIZE(LDO1_table) is 4, vol_nbits of LDO1 is 2.
for (i = 0; i < (2 << info->vol_nbits); i++)  is equivalent to
for (i = 0; i < 8; i++)
which is wrong.

The same value range checking also applies for index in pm8607_list_voltage().

Signed-off-by: Axel Lin <axel.lin@gmail.com>
---
 drivers/regulator/88pm8607.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/regulator/88pm8607.c b/drivers/regulator/88pm8607.c
index 7d149a8..2ce2eb7 100644
--- a/drivers/regulator/88pm8607.c
+++ b/drivers/regulator/88pm8607.c
@@ -215,7 +215,7 @@ static int pm8607_list_voltage(struct regulator_dev *rdev, unsigned index)
 	struct pm8607_regulator_info *info = rdev_get_drvdata(rdev);
 	int ret = -EINVAL;
 
-	if (info->vol_table && (index < (2 << info->vol_nbits))) {
+	if (info->vol_table && (index < (1 << info->vol_nbits))) {
 		ret = info->vol_table[index];
 		if (info->slope_double)
 			ret <<= 1;
@@ -233,7 +233,7 @@ static int choose_voltage(struct regulator_dev *rdev, int min_uV, int max_uV)
 		max_uV = max_uV >> 1;
 	}
 	if (info->vol_table) {
-		for (i = 0; i < (2 << info->vol_nbits); i++) {
+		for (i = 0; i < (1 << info->vol_nbits); i++) {
 			if (!info->vol_table[i])
 				break;
 			if ((min_uV <= info->vol_table[i])
-- 
1.7.0.4

Re: [PATCH] regulator: 88pm8607 - fix value range checking for accessing info->vol_table

[Mark Brown]

On Sat, Sep 04, 2010 at 11:10:48PM +0800, Axel Lin wrote:
> In choose_voltage(), we use i as array index of info->vol_table.
> The valid value range for i should be 0 .. ARRAY_SIZE(info->vol_table) - 1.
> 
> Take LDO1 as example, ARRAY_SIZE(LDO1_table) is 4, vol_nbits of LDO1 is 2.
> for (i = 0; i < (2 << info->vol_nbits); i++)  is equivalent to
> for (i = 0; i < 8; i++)
> which is wrong.
> 
> The same value range checking also applies for index in pm8607_list_voltage().
> 
> Signed-off-by: Axel Lin <axel.lin@gmail.com>

Acked-by: Mark Brown <broonie@openource.wolfsonmicro.com>