diff options
| author | Andrzej Hajda <a.hajda@samsung.com> | 2017-02-20 19:57:57 +0100 |
|---|---|---|
| committer | Rafael J. Wysocki <rafael.j.wysocki@intel.com> | 2017-02-23 23:00:31 +0100 |
| commit | 8cc311167c22f9365304b2b20225df2d881c8843 (patch) | |
| tree | 50a3a64fde614adcd01d983903970b165fb43087 | |
| parent | 0764c604c8128f17fd740ff8b1701d0a1301eb7e (diff) | |
| download | linux-8cc311167c22f9365304b2b20225df2d881c8843.tar.bz2 | |
PM / OPP: fix off-by-one bug in dev_pm_opp_get_max_volt_latency loop
Reading array at given index before checking if index is valid results in
illegal memory access.
The bug was detected using KASAN framework.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
| -rw-r--r-- | drivers/base/power/opp/core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c index 91ec3232d630..dae61720b314 100644 --- a/drivers/base/power/opp/core.c +++ b/drivers/base/power/opp/core.c @@ -231,7 +231,8 @@ unsigned long dev_pm_opp_get_max_volt_latency(struct device *dev) * The caller needs to ensure that opp_table (and hence the regulator) * isn't freed, while we are executing this routine. */ - for (i = 0; reg = regulators[i], i < count; i++) { + for (i = 0; i < count; i++) { + reg = regulators[i]; ret = regulator_set_voltage_time(reg, uV[i].min, uV[i].max); if (ret > 0) latency_ns += ret * 1000; |