Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751760AbcC2Gxq (ORCPT ); Tue, 29 Mar 2016 02:53:46 -0400 Received: from webbox1416.server-home.net ([77.236.96.61]:44913 "EHLO webbox1416.server-home.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750717AbcC2Gxo (ORCPT ); Tue, 29 Mar 2016 02:53:44 -0400 From: Alexander Stein To: Mark Brown , Greg Kroah-Hartman Cc: Alexander Stein , linux-kernel@vger.kernel.org Subject: [PATCH 1/1] regcache: flat: Require max_registers to be set Date: Tue, 29 Mar 2016 08:53:32 +0200 Message-Id: <1459234412-27192-1-git-send-email-alexander.stein@systec-electronic.com> X-Mailer: git-send-email 2.7.3 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 831 Lines: 24 If max_register is unset, regcache_flat_get_index will return 0 and only memory for 1 unsigned int will be allocated, resulting in writing out of bounds. Signed-off-by: Alexander Stein --- drivers/base/regmap/regcache-flat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/base/regmap/regcache-flat.c b/drivers/base/regmap/regcache-flat.c index 3ee7255..4d2e50b 100644 --- a/drivers/base/regmap/regcache-flat.c +++ b/drivers/base/regmap/regcache-flat.c @@ -27,7 +27,7 @@ static int regcache_flat_init(struct regmap *map) int i; unsigned int *cache; - if (!map || map->reg_stride_order < 0) + if (!map || map->reg_stride_order < 0 || !map->max_register) return -EINVAL; map->cache = kcalloc(regcache_flat_get_index(map, map->max_register) -- 2.7.3