| Date | Thu, 23 Jun 2022 12:03:43 +0300 | Subject | Re: [PATCH 02/49] regmap-irq: Fix offset/index mismatch in read_sub_irq_data() | From | Matti Vaittinen <> |
| |
On 6/20/22 23:05, Aidan MacDonald wrote: > We need to divide the sub-irq status register offset by register > stride to get an index for the status buffer to avoid an out of > bounds write when the register stride is greater than 1. > > Fixes: a2d21848d921 ("regmap: regmap-irq: Add main status register support") > Signed-off-by: Aidan MacDonald <aidanmacdonald.0x0@gmail.com> > --- > drivers/base/regmap/regmap-irq.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c > index 4f785bc7981c..a6db605707b0 100644 > --- a/drivers/base/regmap/regmap-irq.c > +++ b/drivers/base/regmap/regmap-irq.c > @@ -387,6 +387,7 @@ static inline int read_sub_irq_data(struct regmap_irq_chip_data *data, > subreg = &chip->sub_reg_offsets[b]; > for (i = 0; i < subreg->num_regs; i++) { > unsigned int offset = subreg->offset[i]; > + unsigned int index = offset / map->reg_stride; > > if (chip->not_fixed_stride) > ret = regmap_read(map, > @@ -395,7 +396,7 @@ static inline int read_sub_irq_data(struct regmap_irq_chip_data *data, > else > ret = regmap_read(map, > chip->status_base + offset, > - &data->status_buf[offset]); > + &data->status_buf[index]); > > if (ret) > break;
Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
-- Matti Vaittinen Linux kernel developer at ROHM Semiconductors Oulu Finland
~~ When things go utterly wrong vim users can always type :help! ~~
Discuss - Estimate - Plan - Report and finally accomplish this: void do_work(int time) __attribute__ ((const));
|