Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 48a1e1b5 authored by Beniamino Galvani's avatar Beniamino Galvani Committed by Mark Brown
Browse files

regulator: act8865: fix parsing of platform data 



The driver loops through all available regulators (ACT8865_REG_NUM)
and accesses pdata->regulators[i].platform_data without checking the
actual value of num_regulators in platform data, potentially causing a
invalid memory access.

Fix this and look up the regulator init_data by id in platform data.

Signed-off-by: default avatarBeniamino Galvani <b.galvani@gmail.com>
Tested-by Wenyou.Yang <wenyou.yang@atmel.com>
Signed-off-by: default avatarMark Brown <broonie@linaro.org>
parent 7171511e

drivers/regulator/act8865-regulator.c

+21 −8
Original line number Diff line number Diff line
@@ -252,6 +252,22 @@ static inline int act8865_pdata_from_dt(struct device *dev, 
}

#endif



static struct regulator_init_data

*act8865_get_init_data(int id, struct act8865_platform_data *pdata)

{

	int i;



	if (!pdata)

		return NULL;



	for (i = 0; i < pdata->num_regulators; i++) {

		if (pdata->regulators[i].id == id)

			return pdata->regulators[i].platform_data;

	}



	return NULL;

}



static int act8865_pmic_probe(struct i2c_client *client,

			   const struct i2c_device_id *i2c_id)

{
@@ -261,7 +277,7 @@ static int act8865_pmic_probe(struct i2c_client *client, 
	struct regulator_config config = { };

	struct act8865 *act8865;

	struct device_node *of_node[ACT8865_REG_NUM];

	int i, id;

	int i;

	int ret = -EINVAL;

	int error;
@@ -299,20 +315,17 @@ static int act8865_pmic_probe(struct i2c_client *client, 


	/* Finally register devices */

	for (i = 0; i < ACT8865_REG_NUM; i++) {



		id = pdata->regulators[i].id;

		const struct regulator_desc *desc = &act8865_reg[i];



		config.dev = dev;

		config.init_data = pdata->regulators[i].platform_data;

		config.init_data = act8865_get_init_data(desc->id, pdata);

		config.of_node = of_node[i];

		config.driver_data = act8865;

		config.regmap = act8865->regmap;



		rdev = devm_regulator_register(&client->dev, &act8865_reg[i],

					       &config);

		rdev = devm_regulator_register(&client->dev, desc, &config);

		if (IS_ERR(rdev)) {

			dev_err(dev, "failed to register %s\n",

				act8865_reg[id].name);

			dev_err(dev, "failed to register %s\n", desc->name);

			return PTR_ERR(rdev);

		}

	}