From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753300AbdDNCu5 (ORCPT ); Thu, 13 Apr 2017 22:50:57 -0400 Received: from mail-pg0-f66.google.com ([74.125.83.66]:35310 "EHLO mail-pg0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753145AbdDNCu4 (ORCPT ); Thu, 13 Apr 2017 22:50:56 -0400 From: Axel Lin To: Mark Brown Cc: Matthias Kaehlcke , Rob Herring , Liam Girdwood , linux-kernel@vger.kernel.org, Axel Lin Subject: [PATCH] regulator: vctrl: Fix out of bounds array access for vctrl->vtable Date: Fri, 14 Apr 2017 10:50:43 +0800 Message-Id: <20170414025043.13680-1-axel.lin@ingics.com> X-Mailer: git-send-email 2.9.3 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Current code only allocates rdesc->n_voltages entries for vctrl->vtable. Thus use rdesc->n_voltages instead of n_voltages in the for loop. While at it, also switch to use devm_kcalloc instead of devm_kmalloc_array + __GFP_ZERO flag and fix the argument order. Signed-off-by: Axel Lin --- drivers/regulator/vctrl-regulator.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/regulator/vctrl-regulator.c b/drivers/regulator/vctrl-regulator.c index 6baadef..78de002 100644 --- a/drivers/regulator/vctrl-regulator.c +++ b/drivers/regulator/vctrl-regulator.c @@ -345,9 +345,9 @@ static int vctrl_init_vtable(struct platform_device *pdev) return -EINVAL; } - vctrl->vtable = devm_kmalloc_array( - &pdev->dev, sizeof(struct vctrl_voltage_table), - rdesc->n_voltages, GFP_KERNEL | __GFP_ZERO); + vctrl->vtable = devm_kcalloc(&pdev->dev, rdesc->n_voltages, + sizeof(struct vctrl_voltage_table), + GFP_KERNEL); if (!vctrl->vtable) return -ENOMEM; @@ -371,7 +371,7 @@ static int vctrl_init_vtable(struct platform_device *pdev) NULL); /* pre-calculate OVP-safe downward transitions */ - for (i = n_voltages - 1; i > 0; i--) { + for (i = rdesc->n_voltages - 1; i > 0; i--) { int j; int ovp_min_uV = (vctrl->vtable[i].out * (100 - vctrl->ovp_threshold)) / 100; -- 2.9.3