Skip to content

Commit 2ba546e

Browse files
nmenonbroonie
authored andcommitted
regulator: ti-abb: Fix array out of bound read access on the first transition
At the start of driver initialization, we do not know what bias setting the bootloader has configured the system for and we only know for certain the very first time we do a transition. However, since the initial value of the comparison index is -EINVAL, this negative value results in an array out of bound access on the very first transition. Since we don't know what the setting is, we just set the bias configuration as there is nothing to compare against. This prevents the array out of bound access. NOTE: Even though we could use a more relaxed check of "< 0" the only valid values(ignoring cosmic ray induced bitflips) are -EINVAL, 0+. Fixes: 40b1936 ("regulator: Introduce TI Adaptive Body Bias(ABB) on-chip LDO driver") Link: https://lore.kernel.org/linux-mm/CA+G9fYuk4imvhyCN7D7T6PMDH6oNp6HDCRiTUKMQ6QXXjBa4ag@mail.gmail.com/ Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Nishanth Menon <nm@ti.com> Link: https://lore.kernel.org/r/20201118145009.10492-1-nm@ti.com Signed-off-by: Mark Brown <broonie@kernel.org>
1 parent f5c042b commit 2ba546e

File tree

1 file changed

+11
-1
lines changed

1 file changed

+11
-1
lines changed

drivers/regulator/ti-abb-regulator.c

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -342,15 +342,25 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
342342
return ret;
343343
}
344344

345-
/* If data is exactly the same, then just update index, no change */
346345
info = &abb->info[sel];
346+
/*
347+
* When Linux kernel is starting up, we are'nt sure of the
348+
* Bias configuration that bootloader has configured.
349+
* So, we get to know the actual setting the first time
350+
* we are asked to transition.
351+
*/
352+
if (abb->current_info_idx == -EINVAL)
353+
goto just_set_abb;
354+
355+
/* If data is exactly the same, then just update index, no change */
347356
oinfo = &abb->info[abb->current_info_idx];
348357
if (!memcmp(info, oinfo, sizeof(*info))) {
349358
dev_dbg(dev, "%s: Same data new idx=%d, old idx=%d\n", __func__,
350359
sel, abb->current_info_idx);
351360
goto out;
352361
}
353362

363+
just_set_abb:
354364
ret = ti_abb_set_opp(rdev, abb, info);
355365

356366
out:

0 commit comments

Comments
 (0)