Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 62737d44 authored by Roel Kluin's avatar Roel Kluin Committed by Liam Girdwood
Browse files

regulator/lp3971: vol_map out of bounds in lp3971_{ldo,dcdc}_set_voltage() 



After `for (val = LDO_VOL_MIN_IDX; val <= LDO_VOL_MAX_IDX; val++)', if no break
occurs, val reaches LDO_VOL_MIN_IDX + 1, which is out of bounds for
ldo45_voltage_map[] and ldo123_voltage_map[].

Similarly BUCK_TARGET_VOL_MAX_IDX + 1 is out of bounds for buck_voltage_map[].

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Acked-by: default avatarMark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: default avatarLiam Girdwood <lrg@slimlogic.co.uk>
parent 973e9a27

drivers/regulator/lp3971.c

+2 −2
Original line number Diff line number Diff line
@@ -183,7 +183,7 @@ static int lp3971_ldo_set_voltage(struct regulator_dev *dev, 
		if (vol_map[val] >= min_vol)

			break;



	if (vol_map[val] > max_vol)

	if (val > LDO_VOL_MAX_IDX || vol_map[val] > max_vol)

		return -EINVAL;



	return lp3971_set_bits(lp3971, LP3971_LDO_VOL_CONTR_REG(ldo),
@@ -272,7 +272,7 @@ static int lp3971_dcdc_set_voltage(struct regulator_dev *dev, 
		if (vol_map[val] >= min_vol)

			break;



	if (vol_map[val] > max_vol)

	if (val > BUCK_TARGET_VOL_MAX_IDX || vol_map[val] > max_vol)

		return -EINVAL;



	ret = lp3971_set_bits(lp3971, LP3971_BUCK_TARGET_VOL1_REG(buck),