Merge "power: qpnp-fg: fix out-of-bound array access" (6bd008ac) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/power/qpnp-fg.c

+10 −1

Original line number	Original line	Diff line number	Diff line
	@@ -2253,6 +2253,9 @@ static int fg_get_cycle_count(struct fg_chip *chip)
	if (!chip->cyc_ctr.en)		if (!chip->cyc_ctr.en)
	return 0;		return 0;

			if ((chip->cyc_ctr.id <= 0) \|\| (chip->cyc_ctr.id > BUCKET_COUNT))
			return -EINVAL;

	mutex_lock(&chip->cyc_ctr.lock);		mutex_lock(&chip->cyc_ctr.lock);
	count = chip->cyc_ctr.count[chip->cyc_ctr.id - 1];		count = chip->cyc_ctr.count[chip->cyc_ctr.id - 1];
	mutex_unlock(&chip->cyc_ctr.lock);		mutex_unlock(&chip->cyc_ctr.lock);
	@@ -3092,7 +3095,13 @@ static int fg_power_set_property(struct power_supply *psy,
	}		}
	break;		break;
	case POWER_SUPPLY_PROP_CYCLE_COUNT_ID:		case POWER_SUPPLY_PROP_CYCLE_COUNT_ID:
			if ((val->intval > 0) && (val->intval <= BUCKET_COUNT)) {
	chip->cyc_ctr.id = val->intval;		chip->cyc_ctr.id = val->intval;
			} else {
			pr_err("rejecting invalid cycle_count_id = %d\n",
			val->intval);
			rc = -EINVAL;
			}
	break;		break;
	default:		default:
	return -EINVAL;		return -EINVAL;