diff options
| author | Wei Yongjun <weiyongjun1@huawei.com> | 2022-08-27 07:32:23 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-10-26 13:19:40 +0200 |
| commit | 24a0be36e9a21f63de2e6088607e689e59ec15f4 (patch) | |
| tree | 9284ef220cdfaab0cf57f8f8c457a7e0b2208c59 | |
| parent | c7b4641bd2395c2f3cd3b0a0cbf292ed9d489398 (diff) | |
| download | linux-stable-24a0be36e9a21f63de2e6088607e689e59ec15f4.tar.gz linux-stable-24a0be36e9a21f63de2e6088607e689e59ec15f4.tar.bz2 linux-stable-24a0be36e9a21f63de2e6088607e689e59ec15f4.zip | |
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
[ Upstream commit 9d47e01b9d807808224347935562f7043a358054 ]
ADP5061_CHG_STATUS_1_CHG_STATUS is masked with 0x07, which means a length
of 8, but adp5061_chg_type array size is 4, may end up reading 4 elements
beyond the end of the adp5061_chg_type[] array.
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Acked-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/power/supply/adp5061.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/power/supply/adp5061.c b/drivers/power/supply/adp5061.c index 939fd3d8fb1a..1ad044330599 100644 --- a/drivers/power/supply/adp5061.c +++ b/drivers/power/supply/adp5061.c @@ -428,11 +428,11 @@ static int adp5061_get_chg_type(struct adp5061_state *st, if (ret < 0) return ret; - chg_type = adp5061_chg_type[ADP5061_CHG_STATUS_1_CHG_STATUS(status1)]; - if (chg_type > ADP5061_CHG_FAST_CV) + chg_type = ADP5061_CHG_STATUS_1_CHG_STATUS(status1); + if (chg_type >= ARRAY_SIZE(adp5061_chg_type)) val->intval = POWER_SUPPLY_STATUS_UNKNOWN; else - val->intval = chg_type; + val->intval = adp5061_chg_type[chg_type]; return ret; } |