mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-05 16:37:50 +00:00
Code Issues Releases Wiki Activity

power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()

Browse source 
[ Upstream commit 9d47e01b9d ]

ADP5061_CHG_STATUS_1_CHG_STATUS is masked with 0x07, which means a length
of 8, but adp5061_chg_type array size is 4, may end up reading 4 elements
beyond the end of the adp5061_chg_type[] array.

Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Acked-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Wei Yongjun 2022-08-27 07:32:23 +00:00 committed by Greg Kroah-Hartman
parent 5609dcc9c3
commit dc52b73d3a
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/power/supply/adp5061.c
View file

@ -427,11 +427,11 @@ static int adp5061_get_chg_type(struct adp5061_state *st,
if (ret < 0)
return ret;
chg_type = adp5061_chg_type[ADP5061_CHG_STATUS_1_CHG_STATUS(status1)];
if (chg_type > ADP5061_CHG_FAST_CV)
chg_type = ADP5061_CHG_STATUS_1_CHG_STATUS(status1);
if (chg_type >= ARRAY_SIZE(adp5061_chg_type))
val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
else
val->intval = chg_type;
val->intval = adp5061_chg_type[chg_type];
return ret;
}