| Message ID | 20200910161817.27535-1-patrick.delaunay@st.com |
|---|---|
| State | Accepted |
| Commit | 2d69b0861811711a27ac535fd8a611a9cdb68d43 |
| Delegated to: | Tom Rini |
| Headers | show |
| Series | [1/2] power: regulator: gpio-regulator: protect count value | expand |
On Thu, 10 Sep 2020 at 10:18, Patrick Delaunay <patrick.delaunay@st.com> wrote: > > Update the size of states_array to avoid overflow for > dev_pdata->voltages[j] and dev_pdata->states[j]. > > As the size of array is GPIO_REGULATOR_MAX_STATES, the size of > states_array is limited by GPIO_REGULATOR_MAX_STATES * 2 = 4 > instead of 8 previously. > > The value of the "count" variable is limited by the third parameter of > fdtdec_get_int_array_count. > > Signed-off-by: Patrick Delaunay <patrick.delaunay@st.com> > --- > > drivers/power/regulator/gpio-regulator.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > Reviewed-by: Simon Glass <sjg@chromium.org>
On Thu, Sep 10, 2020 at 06:18:16PM +0200, Patrick Delaunay wrote: > Update the size of states_array to avoid overflow for > dev_pdata->voltages[j] and dev_pdata->states[j]. > > As the size of array is GPIO_REGULATOR_MAX_STATES, the size of > states_array is limited by GPIO_REGULATOR_MAX_STATES * 2 = 4 > instead of 8 previously. > > The value of the "count" variable is limited by the third parameter of > fdtdec_get_int_array_count. > > Signed-off-by: Patrick Delaunay <patrick.delaunay@st.com> > Reviewed-by: Simon Glass <sjg@chromium.org> Applied to u-boot/master, thanks!
diff --git a/drivers/power/regulator/gpio-regulator.c b/drivers/power/regulator/gpio-regulator.c index 947f812d09..017a3644fe 100644 --- a/drivers/power/regulator/gpio-regulator.c +++ b/drivers/power/regulator/gpio-regulator.c @@ -35,7 +35,7 @@ static int gpio_regulator_ofdata_to_platdata(struct udevice *dev) const void *blob = gd->fdt_blob; int node = dev_of_offset(dev); int ret, count, i, j; - u32 states_array[8]; + u32 states_array[GPIO_REGULATOR_MAX_STATES * 2]; dev_pdata = dev_get_platdata(dev); uc_pdata = dev_get_uclass_platdata(dev); @@ -58,7 +58,8 @@ static int gpio_regulator_ofdata_to_platdata(struct udevice *dev) debug("regulator gpio - not found! Error: %d", ret); count = fdtdec_get_int_array_count(blob, node, "states", - states_array, 8); + states_array, + ARRAY_SIZE(states_array)); if (!count) return -EINVAL;
Update the size of states_array to avoid overflow for dev_pdata->voltages[j] and dev_pdata->states[j]. As the size of array is GPIO_REGULATOR_MAX_STATES, the size of states_array is limited by GPIO_REGULATOR_MAX_STATES * 2 = 4 instead of 8 previously. The value of the "count" variable is limited by the third parameter of fdtdec_get_int_array_count. Signed-off-by: Patrick Delaunay <patrick.delaunay@st.com> --- drivers/power/regulator/gpio-regulator.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)