Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a9bbb453 authored by Axel Lin's avatar Axel Lin Committed by Mark Brown
Browse files

regulator: vctrl: Fix out of bounds array access for vctrl->vtable 



Current code only allocates rdesc->n_voltages entries for vctrl->vtable.
Thus use rdesc->n_voltages instead of n_voltages in the for loop.

While at it, also switch to use devm_kcalloc instead of devm_kmalloc_array
+ __GFP_ZERO flag and fix the argument order.

Signed-off-by: default avatarAxel Lin <axel.lin@ingics.com>
Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 9dee7a72

drivers/regulator/vctrl-regulator.c

+4 −4
Original line number Diff line number Diff line
@@ -345,9 +345,9 @@ static int vctrl_init_vtable(struct platform_device *pdev) 
		return -EINVAL;

	}



	vctrl->vtable = devm_kmalloc_array(

		&pdev->dev, sizeof(struct vctrl_voltage_table),

		rdesc->n_voltages, GFP_KERNEL | __GFP_ZERO);

	vctrl->vtable = devm_kcalloc(&pdev->dev, rdesc->n_voltages,

				     sizeof(struct vctrl_voltage_table),

				     GFP_KERNEL);

	if (!vctrl->vtable)

		return -ENOMEM;
@@ -371,7 +371,7 @@ static int vctrl_init_vtable(struct platform_device *pdev) 
	     NULL);



	/* pre-calculate OVP-safe downward transitions */

	for (i = n_voltages - 1; i > 0; i--) {

	for (i = rdesc->n_voltages - 1; i > 0; i--) {

		int j;

		int ovp_min_uV = (vctrl->vtable[i].out *

				  (100 - vctrl->ovp_threshold)) / 100;