* [PATCH] power: supply: adp5061: Fix a couple off by ones
@ 2018-07-11 7:58 Dan Carpenter
2018-07-11 10:04 ` Sebastian Reichel
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2018-07-11 7:58 UTC (permalink / raw)
To: Stefan Popa; +Cc: Sebastian Reichel, linux-pm, linux-kernel, kernel-janitors
We end up reading one element beyond the end of the adp5061_vmax[] array
here.
Fixes: fe8e81b7e899 ("adp5061: New driver for ADP5061 I2C battery charger")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/power/supply/adp5061.c b/drivers/power/supply/adp5061.c
index c00a02ef7424..939fd3d8fb1a 100644
--- a/drivers/power/supply/adp5061.c
+++ b/drivers/power/supply/adp5061.c
@@ -266,8 +266,8 @@ static int adp5061_get_max_voltage(struct adp5061_state *st,
return ret;
regval = ((regval & ADP5061_TERM_SET_VTRM_MSK) >> 2) - 0x0F;
- if (regval > ARRAY_SIZE(adp5061_vmax))
- regval = ARRAY_SIZE(adp5061_vmax);
+ if (regval >= ARRAY_SIZE(adp5061_vmax))
+ regval = ARRAY_SIZE(adp5061_vmax) - 1;
val->intval = adp5061_vmax[regval] * 1000;
@@ -344,8 +344,8 @@ static int adp5061_get_const_chg_current(struct adp5061_state *st,
return ret;
regval = ((regval & ADP5061_CHG_CURR_ICHG_MSK) >> 2);
- if (regval > ARRAY_SIZE(adp5061_const_ichg))
- regval = ARRAY_SIZE(adp5061_const_ichg);
+ if (regval >= ARRAY_SIZE(adp5061_const_ichg))
+ regval = ARRAY_SIZE(adp5061_const_ichg) - 1;
val->intval = adp5061_const_ichg[regval] * 1000;
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] power: supply: adp5061: Fix a couple off by ones
2018-07-11 7:58 [PATCH] power: supply: adp5061: Fix a couple off by ones Dan Carpenter
@ 2018-07-11 10:04 ` Sebastian Reichel
0 siblings, 0 replies; 2+ messages in thread
From: Sebastian Reichel @ 2018-07-11 10:04 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Stefan Popa, linux-pm, linux-kernel, kernel-janitors
[-- Attachment #1: Type: text/plain, Size: 1379 bytes --]
Hi,
On Wed, Jul 11, 2018 at 10:58:13AM +0300, Dan Carpenter wrote:
> We end up reading one element beyond the end of the adp5061_vmax[] array
> here.
>
> Fixes: fe8e81b7e899 ("adp5061: New driver for ADP5061 I2C battery charger")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Thanks, queued.
-- Sebastian
> diff --git a/drivers/power/supply/adp5061.c b/drivers/power/supply/adp5061.c
> index c00a02ef7424..939fd3d8fb1a 100644
> --- a/drivers/power/supply/adp5061.c
> +++ b/drivers/power/supply/adp5061.c
> @@ -266,8 +266,8 @@ static int adp5061_get_max_voltage(struct adp5061_state *st,
> return ret;
>
> regval = ((regval & ADP5061_TERM_SET_VTRM_MSK) >> 2) - 0x0F;
> - if (regval > ARRAY_SIZE(adp5061_vmax))
> - regval = ARRAY_SIZE(adp5061_vmax);
> + if (regval >= ARRAY_SIZE(adp5061_vmax))
> + regval = ARRAY_SIZE(adp5061_vmax) - 1;
>
> val->intval = adp5061_vmax[regval] * 1000;
>
> @@ -344,8 +344,8 @@ static int adp5061_get_const_chg_current(struct adp5061_state *st,
> return ret;
>
> regval = ((regval & ADP5061_CHG_CURR_ICHG_MSK) >> 2);
> - if (regval > ARRAY_SIZE(adp5061_const_ichg))
> - regval = ARRAY_SIZE(adp5061_const_ichg);
> + if (regval >= ARRAY_SIZE(adp5061_const_ichg))
> + regval = ARRAY_SIZE(adp5061_const_ichg) - 1;
>
> val->intval = adp5061_const_ichg[regval] * 1000;
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-07-11 10:04 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-07-11 7:58 [PATCH] power: supply: adp5061: Fix a couple off by ones Dan Carpenter
2018-07-11 10:04 ` Sebastian Reichel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).