From a9bbb453b50c91295ab362e4832eb37fd4e6785d Mon Sep 17 00:00:00 2001 From: Axel Lin Date: Fri, 14 Apr 2017 10:50:43 +0800 Subject: [PATCH] regulator: vctrl: Fix out of bounds array access for vctrl->vtable Current code only allocates rdesc->n_voltages entries for vctrl->vtable. Thus use rdesc->n_voltages instead of n_voltages in the for loop. While at it, also switch to use devm_kcalloc instead of devm_kmalloc_array + __GFP_ZERO flag and fix the argument order. Signed-off-by: Axel Lin Signed-off-by: Mark Brown --- drivers/regulator/vctrl-regulator.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/regulator/vctrl-regulator.c b/drivers/regulator/vctrl-regulator.c index 6baadef0ed74..78de002037c7 100644 --- a/drivers/regulator/vctrl-regulator.c +++ b/drivers/regulator/vctrl-regulator.c @@ -345,9 +345,9 @@ static int vctrl_init_vtable(struct platform_device *pdev) return -EINVAL; } - vctrl->vtable = devm_kmalloc_array( - &pdev->dev, sizeof(struct vctrl_voltage_table), - rdesc->n_voltages, GFP_KERNEL | __GFP_ZERO); + vctrl->vtable = devm_kcalloc(&pdev->dev, rdesc->n_voltages, + sizeof(struct vctrl_voltage_table), + GFP_KERNEL); if (!vctrl->vtable) return -ENOMEM; @@ -371,7 +371,7 @@ static int vctrl_init_vtable(struct platform_device *pdev) NULL); /* pre-calculate OVP-safe downward transitions */ - for (i = n_voltages - 1; i > 0; i--) { + for (i = rdesc->n_voltages - 1; i > 0; i--) { int j; int ovp_min_uV = (vctrl->vtable[i].out * (100 - vctrl->ovp_threshold)) / 100;