Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3376a0cf authored by Wei Yongjun's avatar Wei Yongjun Committed by Greg Kroah-Hartman
Browse files

power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type() 



[ Upstream commit 9d47e01b9d807808224347935562f7043a358054 ]

ADP5061_CHG_STATUS_1_CHG_STATUS is masked with 0x07, which means a length
of 8, but adp5061_chg_type array size is 4, may end up reading 4 elements
beyond the end of the adp5061_chg_type[] array.

Signed-off-by: default avatarWei Yongjun <weiyongjun1@huawei.com>
Acked-by: default avatarMichael Hennerich <michael.hennerich@analog.com>
Signed-off-by: default avatarSebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 35759495

drivers/power/supply/adp5061.c

+3 −3
Original line number Diff line number Diff line
@@ -427,11 +427,11 @@ static int adp5061_get_chg_type(struct adp5061_state *st, 
	if (ret < 0)

		return ret;



	chg_type = adp5061_chg_type[ADP5061_CHG_STATUS_1_CHG_STATUS(status1)];

	if (chg_type > ADP5061_CHG_FAST_CV)

	chg_type = ADP5061_CHG_STATUS_1_CHG_STATUS(status1);

	if (chg_type >= ARRAY_SIZE(adp5061_chg_type))

		val->intval = POWER_SUPPLY_STATUS_UNKNOWN;

	else

		val->intval = chg_type;

		val->intval = adp5061_chg_type[chg_type];



	return ret;

}