linux-kernel - [RESEND][PATCH] Fix nr_types assignment for TPS6594/3 and TPS65224

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 3 Jun 2024 14:25:00 -0500
From: Shree Ramamoorthy <s-ramamoorthy@...com>
To: <lgirdwood@...il.com>, <linux-kernel@...r.kernel.org>
CC: <m-leonard@...com>, <u-kumar1@...com>, <n-francis@...com>,
        <bhargav.r@...s.com>, <m.nirmaladevi@...s.com>, <vigneshr@...com>,
        Shree
 Ramamoorthy <s-ramamoorthy@...com>
Subject: [RESEND][PATCH] Fix nr_types assignment for TPS6594/3 and TPS65224

Fixes: 00c826525fba ("regulator: tps6594-regulator: Add TI TPS65224 PMIC regulators")

Marked as resend to include the correct Fixes: tag.

TPS6594/3 and TPS65224's nr_types assignment were incorrectly swamped in
probe(), leading to memory underallocation and a NULL pointer error. 
Error detected in and solution tested on J7200 EVM.

Error logs:
[   13.974024] Call trace:
[   13.974025]  _regulator_put.part.0+0x40/0x48
[   13.974028]  regulator_register+0x2b0/0xa00
[   13.974031]  devm_regulator_register+0x58/0xa0
[   13.974035]  tps6594_regulator_probe+0x4e0/0x5f0 [tps6594_regulator]
...
[   13.974178] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004
---
 drivers/regulator/tps6594-regulator.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/regulator/tps6594-regulator.c b/drivers/regulator/tps6594-regulator.c
index 4a859f4c0f83..b66608ab2546 100644
--- a/drivers/regulator/tps6594-regulator.c
+++ b/drivers/regulator/tps6594-regulator.c
@@ -660,11 +660,11 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
 	} else if (tps->chip_id == TPS65224) {
 		nr_buck = ARRAY_SIZE(tps65224_buck_regs);
 		nr_ldo = ARRAY_SIZE(tps65224_ldo_regs);
-		nr_types = REGS_INT_NB;
+		nr_types = TPS65224_REGS_INT_NB;
 	} else {
 		nr_buck = ARRAY_SIZE(buck_regs);
 		nr_ldo = ARRAY_SIZE(tps6594_ldo_regs);
-		nr_types = TPS65224_REGS_INT_NB;
+		nr_types = REGS_INT_NB;
 	}
 
 	reg_irq_nb = nr_types * (nr_buck + nr_ldo);
-- 
Signed-off-by: Shree Ramamoorthy <s-ramamoorthy@...com>