From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:53466 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726652AbeKLGJu (ORCPT ); Mon, 12 Nov 2018 01:09:50 -0500 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Dan Carpenter" , "Lee Jones" Date: Sun, 11 Nov 2018 19:49:05 +0000 Message-ID: Subject: [PATCH 3.16 056/366] mfd: tps65911-comparator: Fix an off by one bug In-Reply-To: Sender: stable-owner@vger.kernel.org List-ID: 3.16.61-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Lee Jones commit 1768391c3674b0c6bdc4947121f15fb0c2f47ec4 upstream. The COMP1 and COMP2 elements are in 0 and 1 respectively so this code is accessing the wrong elements and one space beyond the end of the array. The "id" variable is never COMP (0) so that code can be removed. Fixes: 6851ad3ab346 ("TPS65911: Comparator: Add comparator driver") Reported-by: Dan Carpenter Signed-off-by: Lee Jones Signed-off-by: Ben Hutchings --- drivers/mfd/tps65911-comparator.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) --- a/drivers/mfd/tps65911-comparator.c +++ b/drivers/mfd/tps65911-comparator.c @@ -22,9 +22,8 @@ #include #include -#define COMP 0 -#define COMP1 1 -#define COMP2 2 +#define COMP1 0 +#define COMP2 1 /* Comparator 1 voltage selection table in millivolts */ static const u16 COMP_VSEL_TABLE[] = { @@ -63,9 +62,6 @@ static int comp_threshold_set(struct tps int ret; u8 index = 0, val; - if (id == COMP) - return 0; - while (curr_voltage < tps_comp.uV_max) { curr_voltage = tps_comp.vsel_table[index]; if (curr_voltage >= voltage) @@ -89,9 +85,6 @@ static int comp_threshold_get(struct tps unsigned int val; int ret; - if (id == COMP) - return 0; - ret = tps65910_reg_read(tps65910, tps_comp.reg, &val); if (ret < 0) return ret;