regulator/lp3971: vol_map out of bounds in lp3971_{ldo,dcdc}_set_voltage()
After `for (val = LDO_VOL_MIN_IDX; val <= LDO_VOL_MAX_IDX; val++)', if no break occurs, val reaches LDO_VOL_MIN_IDX + 1, which is out of bounds for ldo45_voltage_map[] and ldo123_voltage_map[]. Similarly BUCK_TARGET_VOL_MAX_IDX + 1 is out of bounds for buck_voltage_map[]. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
This commit is contained in:
parent
973e9a2795
commit
62737d445b
|
@ -183,7 +183,7 @@ static int lp3971_ldo_set_voltage(struct regulator_dev *dev,
|
|||
if (vol_map[val] >= min_vol)
|
||||
break;
|
||||
|
||||
if (vol_map[val] > max_vol)
|
||||
if (val > LDO_VOL_MAX_IDX || vol_map[val] > max_vol)
|
||||
return -EINVAL;
|
||||
|
||||
return lp3971_set_bits(lp3971, LP3971_LDO_VOL_CONTR_REG(ldo),
|
||||
|
@ -272,7 +272,7 @@ static int lp3971_dcdc_set_voltage(struct regulator_dev *dev,
|
|||
if (vol_map[val] >= min_vol)
|
||||
break;
|
||||
|
||||
if (vol_map[val] > max_vol)
|
||||
if (val > BUCK_TARGET_VOL_MAX_IDX || vol_map[val] > max_vol)
|
||||
return -EINVAL;
|
||||
|
||||
ret = lp3971_set_bits(lp3971, LP3971_BUCK_TARGET_VOL1_REG(buck),
|
||||
|
|
Loading…
Reference in New Issue