From: Thomas Jarosch <thomas.jarosch@intra2net.com>
To: Jorge Eduardo Candelaria <jedu@slimlogic.co.uk>
Cc: linux-kernel@vger.kernel.org
Subject: [RFC PATCH, untested] Fix off-by-one in tps_comparators[] access
Date: Sat, 13 Dec 2014 01:54:40 +0100 [thread overview]
Message-ID: <548B8E50.1000106@intra2net.com> (raw)
The array tps_comparators starts at zero,
yet COMP1 starts at 1. So COMP2 is out of bounds.
cppcheck reported:
[drivers/mfd/tps65911-comparator.c:61]: (error) Array 'tps_comparators[2]' accessed at index 2, which is out of bounds.
[drivers/mfd/tps65911-comparator.c:88]: (error) Array 'tps_comparators[2]' accessed at index 2, which is out of bounds.
Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
---
drivers/mfd/tps65911-comparator.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/mfd/tps65911-comparator.c b/drivers/mfd/tps65911-comparator.c
index c0816eb..e8c2e32 100644
--- a/drivers/mfd/tps65911-comparator.c
+++ b/drivers/mfd/tps65911-comparator.c
@@ -58,13 +58,14 @@ static struct comparator tps_comparators[] = {
static int comp_threshold_set(struct tps65910 *tps65910, int id, int voltage)
{
- struct comparator tps_comp = tps_comparators[id];
+ struct comparator tps_comp;
int curr_voltage = 0;
int ret;
u8 index = 0, val;
- if (id == COMP)
+ if (id == COMP || id > COMP2)
return 0;
+ tps_comp = tps_comparators[id-1];
while (curr_voltage < tps_comp.uV_max) {
curr_voltage = tps_comp.vsel_table[index];
@@ -85,12 +86,13 @@ static int comp_threshold_set(struct tps65910 *tps65910, int id, int voltage)
static int comp_threshold_get(struct tps65910 *tps65910, int id)
{
- struct comparator tps_comp = tps_comparators[id];
+ struct comparator tps_comp;
int ret;
u8 val;
- if (id == COMP)
+ if (id == COMP || id > COMP2)
return 0;
+ tps_comp = tps_comparators[id-1];
ret = tps65910->read(tps65910, tps_comp.reg, 1, &val);
if (ret < 0)
--
1.9.3
reply other threads:[~2014-12-13 0:54 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=548B8E50.1000106@intra2net.com \
--to=thomas.jarosch@intra2net.com \
--cc=jedu@slimlogic.co.uk \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®