From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Wei Yongjun <weiyongjun1@huawei.com>,
Michael Hennerich <michael.hennerich@analog.com>,
Sebastian Reichel <sebastian.reichel@collabora.com>,
Sasha Levin <sashal@kernel.org>,
Michael.Hennerich@analog.com, sre@kernel.org,
linux-pm@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 08/27] power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
Date: Wed, 12 Oct 2022 20:24:40 -0400 [thread overview]
Message-ID: <20221013002501.1895204-8-sashal@kernel.org> (raw)
In-Reply-To: <20221013002501.1895204-1-sashal@kernel.org>
From: Wei Yongjun <weiyongjun1@huawei.com>
[ Upstream commit 9d47e01b9d807808224347935562f7043a358054 ]
ADP5061_CHG_STATUS_1_CHG_STATUS is masked with 0x07, which means a length
of 8, but adp5061_chg_type array size is 4, may end up reading 4 elements
beyond the end of the adp5061_chg_type[] array.
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Acked-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/adp5061.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/power/supply/adp5061.c b/drivers/power/supply/adp5061.c
index 003557043ab3..daee1161c305 100644
--- a/drivers/power/supply/adp5061.c
+++ b/drivers/power/supply/adp5061.c
@@ -427,11 +427,11 @@ static int adp5061_get_chg_type(struct adp5061_state *st,
if (ret < 0)
return ret;
- chg_type = adp5061_chg_type[ADP5061_CHG_STATUS_1_CHG_STATUS(status1)];
- if (chg_type > ADP5061_CHG_FAST_CV)
+ chg_type = ADP5061_CHG_STATUS_1_CHG_STATUS(status1);
+ if (chg_type >= ARRAY_SIZE(adp5061_chg_type))
val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
else
- val->intval = chg_type;
+ val->intval = adp5061_chg_type[chg_type];
return ret;
}
--
2.35.1
next prev parent reply other threads:[~2022-10-13 0:31 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-13 0:24 [PATCH AUTOSEL 5.4 01/27] clk: zynqmp: Fix stack-out-of-bounds in strncpy` Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 02/27] media: cx88: Fix a null-ptr-deref bug in buffer_prepare() Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 03/27] clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 04/27] scsi: 3w-9xxx: Avoid disabling device if failing to enable it Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 05/27] nbd: Fix hung when signal interrupts nbd_start_device_ioctl() Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 06/27] staging: rtl8712: Fix return type for implementation of ndo_start_xmit Sasha Levin
2022-10-13 5:55 ` Greg Kroah-Hartman
2022-10-13 17:51 ` Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 07/27] staging: rtl8192e: " Sasha Levin
2022-10-13 5:55 ` Greg Kroah-Hartman
2022-10-13 0:24 ` Sasha Levin [this message]
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 09/27] staging: vt6655: fix potential memory leak Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 10/27] ata: libahci_platform: Sanity check the DT child nodes number Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 11/27] bcache: fix set_at_max_writeback_rate() for multiple attached devices Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 12/27] hid: topre: Add driver fixing report descriptor Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 13/27] HID: roccat: Fix use-after-free in roccat_read() Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 14/27] HSI: ssi_protocol: fix potential resource leak in ssip_pn_open() Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 15/27] md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 16/27] usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 17/27] usb: musb: Fix musb_gadget.c rxstate overflow bug Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 18/27] Revert "usb: storage: Add quirk for Samsung Fit flash" Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 19/27] staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv() Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 20/27] staging: rtl8192u: Fix return type of ieee80211_xmit Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 21/27] staging: octeon: Fix return type of cvm_oct_xmit and cvm_oct_xmit_pow Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 22/27] nvme: copy firmware_rev on each init Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 23/27] nvmet-tcp: add bounds check on Transfer Tag Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 24/27] usb: idmouse: fix an uninit-value in idmouse_open Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 25/27] fsi: master-ast-cf: Fix missing of_node_put in fsi_master_acf_probe Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 26/27] sbitmap: fix lockup while swapping Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 27/27] clk: bcm2835: Make peripheral PLLC critical Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221013002501.1895204-8-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=michael.hennerich@analog.com \
--cc=sebastian.reichel@collabora.com \
--cc=sre@kernel.org \
--cc=stable@vger.kernel.org \
--cc=weiyongjun1@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox