From: Axel Lin <axel.lin@ingics.com>
Date: Sun, 24 Feb 2019 03:21:46 +0000 (+0800)
Subject: regulator: fan53555: Check pdata->slew_rate setting
X-Git-Tag: v5.1-rc1~182^2^2~23
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=87919e0cf166454caf202fcddeea42c8eba700ea;p=thirdparty%2Flinux.git

regulator: fan53555: Check pdata->slew_rate setting

Current code does not really avoid array access out of bounds,
fix it by add checking for pdata->slew_rate.
If pdata->slew_rate is too big, it's a bug in pdata that needs fix.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
---

diff --git a/drivers/regulator/fan53555.c b/drivers/regulator/fan53555.c
index d7142352f6bca..771a06d1900db 100644
--- a/drivers/regulator/fan53555.c
+++ b/drivers/regulator/fan53555.c
@@ -490,11 +490,13 @@ static int fan53555_regulator_probe(struct i2c_client *client,
 	} else {
 		/* if no ramp constraint set, get the pdata ramp_delay */
 		if (!di->regulator->constraints.ramp_delay) {
-			int slew_idx = (pdata->slew_rate & 0x7)
-						? pdata->slew_rate : 0;
+			if (pdata->slew_rate >= ARRAY_SIZE(slew_rates)) {
+				dev_err(&client->dev, "Invalid slew_rate\n");
+				return -EINVAL;
+			}
 
 			di->regulator->constraints.ramp_delay
-						= slew_rates[slew_idx];
+					= slew_rates[pdata->slew_rate];
 		}
 
 		di->vendor = id->driver_data;