Skip to contentSkip to conversation

mfd: Fix off-by-one value range checking for tps65910_i2c_write

PATCH RESEND Applied Axel Lin 2 participants 2 messages May 16, 2011

Subsystems (2)
Multifunction devices (MFD) OMAP2+ support
lore
Share & tools
lore

Axel Lin

author
#0 lore raw

PATCH RESEND 1/1 mfd: Fix off-by-one value range checking for tps65910_i2c_write

If bytes == (TPS65910_MAX_REGISTER + 1), we have a buffer overflow when doing memcpy(&msg[1], src, bytes).

Signed-off-by Axel Lin <[email protected]>
Acked-by Samuel Ortiz <[email protected]>
---
 drivers/mfd/tps65910.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
drivers/mfd/tps65910.c +1 -1
index bf649cf..e318248 100644
@@ -71,7 +71,7 @@ static int tps65910_i2c_write(struct tps65910 *tps65910, u8 reg,
 	u8 msg[TPS65910_MAX_REGISTER + 1];
 	int ret;
 
-	if (bytes > (TPS65910_MAX_REGISTER + 1))
+	if (bytes > TPS65910_MAX_REGISTER)
 		return -EINVAL;
 
 	msg[0] = reg;
Signature · 1 line
1.7.1
Applied
#1 lore raw
Quoted 14 lines · Axel Lin

If bytes == (TPS65910_MAX_REGISTER + 1), we have a buffer overflow when doing memcpy(&msg[1], src, bytes).

Signed-off-by Axel Lin <[email protected]>
Acked-by Samuel Ortiz <[email protected]>
---
 drivers/mfd/tps65910.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
drivers/mfd/tps65910.c +0 -0
index bf649cf..e318248 100644

drivers/mfd/tps65910.c static int tps65910_i2c_write(struct tps65910 *tps65910, u8 reg, · line 77

Quoted 8 lines
drivers/mfd/tps65910.c +1 -1
@@ -71,7 +71,7 @@ static int tps65910_i2c_write(struct tps65910 *tps65910, u8 reg,
 	u8 msg[TPS65910_MAX_REGISTER + 1];
 	int ret;
 
-	if (bytes > (TPS65910_MAX_REGISTER + 1))
+	if (bytes > TPS65910_MAX_REGISTER)
 		return -EINVAL;
 
 	msg[0] = reg;

Applied.