Messages in this thread | | | Date | Fri, 14 Apr 2017 10:11:37 -0700 | From | Matthias Kaehlcke <> | Subject | Re: [PATCH] regulator: vctrl: Fix out of bounds array access for vctrl->vtable |
| |
Hi Axel,
El Fri, Apr 14, 2017 at 10:50:43AM +0800 Axel Lin ha dit:
> Current code only allocates rdesc->n_voltages entries for vctrl->vtable. > Thus use rdesc->n_voltages instead of n_voltages in the for loop.
This is intended. n_voltages is the number of voltages of the control regulator. In the first loop of the function we determine how many of these voltages are usable by the vctrl regulator (=> rdesc->n_voltages). The loop that populates vctrl->vtable iterates over n_voltages, however it skips those that are outside of the voltage range for the control regulator.
> While at it, also switch to use devm_kcalloc instead of devm_kmalloc_array > + __GFP_ZERO flag and fix the argument order.
This looks good to me.
Thanks
Matthias
> Signed-off-by: Axel Lin <axel.lin@ingics.com> > --- > drivers/regulator/vctrl-regulator.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/drivers/regulator/vctrl-regulator.c b/drivers/regulator/vctrl-regulator.c > index 6baadef..78de002 100644 > --- a/drivers/regulator/vctrl-regulator.c > +++ b/drivers/regulator/vctrl-regulator.c > @@ -345,9 +345,9 @@ static int vctrl_init_vtable(struct platform_device *pdev) > return -EINVAL; > } > > - vctrl->vtable = devm_kmalloc_array( > - &pdev->dev, sizeof(struct vctrl_voltage_table), > - rdesc->n_voltages, GFP_KERNEL | __GFP_ZERO); > + vctrl->vtable = devm_kcalloc(&pdev->dev, rdesc->n_voltages, > + sizeof(struct vctrl_voltage_table), > + GFP_KERNEL); > if (!vctrl->vtable) > return -ENOMEM; > > @@ -371,7 +371,7 @@ static int vctrl_init_vtable(struct platform_device *pdev) > NULL); > > /* pre-calculate OVP-safe downward transitions */ > - for (i = n_voltages - 1; i > 0; i--) { > + for (i = rdesc->n_voltages - 1; i > 0; i--) { > int j; > int ovp_min_uV = (vctrl->vtable[i].out * > (100 - vctrl->ovp_threshold)) / 100;
| |