Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   "Hennerich, Michael" <Michael.Hennerich@analog.com>
To:     Wei Yongjun <weiyongjun1@huawei.com>,
        Sebastian Reichel <sre@kernel.org>
CC:     "linux-pm@vger.kernel.org" <linux-pm@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH -next 1/2] power: supply: adp5061: fix out-of-bounds read
 in adp5061_get_chg_type()
Thread-Topic: [PATCH -next 1/2] power: supply: adp5061: fix out-of-bounds read
 in adp5061_get_chg_type()
Thread-Index: AQHYueSs6z5z1PPFf0K5TcOUPI4wCa3QxotQ
Date:   Mon, 5 Sep 2022 11:46:59 +0000
Message-ID: <SJ0PR03MB625357900B5B71F5A770874E8E7F9@SJ0PR03MB6253.namprd03.prod.outlook.com>
References: <20220827073224.713803-1-weiyongjun1@huawei.com>
 <20220827073224.713803-2-weiyongjun1@huawei.com>
In-Reply-To: <20220827073224.713803-2-weiyongjun1@huawei.com>
Accept-Language: de-DE, en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?GvXzrczh6ThSEKKYHJT0bMMVsrGJ65JzfAZlsbtCEo/wQ3cHZc/u3NkoycHT?=
 =?us-ascii?Q?I9l4coQZ17OUJcmIBF1YrWfyKpDtOtmEuVeavmSi7qmMe24oJtPnTQrja4kd?=
 =?us-ascii?Q?7V1L0Fu5IzORbKAqPEMXDbhNY+jYZNEosXNnOXNHgQzcSxicaInzSa+PTehr?=
 =?us-ascii?Q?GqKe+WMel1SGr2LtmyV4Vjkd0Hx9b2EjkPLtlOlFCVtHQfPkP9IpTt+8plPn?=
 =?us-ascii?Q?yLo8rfGQ4/T/6XJ51L0LWXk4So0a5ShFMxQSgL47yWpuxDPVM6gU/B0q48xS?=
 =?us-ascii?Q?d2Rt+LdL8XpcT4JMf/jU1aGu1WwhsEjS4ZMivvpWn/AJhC/MLVEqfC1ZUyJx?=
 =?us-ascii?Q?9oozIEjnnpt44Us7TMqqO/ExlPeMgzaPskDEvqx7fu8iikHEnhIK4XTpHept?=
 =?us-ascii?Q?QbCnxKae5C9PRHDwUlgDKih+Wy0QVFcIvhmE1pnbxnikEBzhJ+WM4XWA9hX6?=
 =?us-ascii?Q?rfw9h4SySoLvK8/+FNN52Dr+NCqjLJ514I9QwVuo/bawsSKM2gdMJzjaR7x/?=
 =?us-ascii?Q?bhLTWpt8mkStyL8VSO93qPW74Eq2RyNKRdfhE3wosaNVtHGHhBzr51DtImjw?=
 =?us-ascii?Q?Q3PMKTjvWUkfHilakisKQ3zXm7Dvl0bhKpTc5e1Y8a/99T+30qR6CQ8hwDv/?=
 =?us-ascii?Q?tYb91YjuE78bNSz9gL1c/SkMNa+iIBR+W/P3OnMPC42xpgDwX0W651FReNgn?=
 =?us-ascii?Q?n7aY49bKZ87UP8nR2p0w6eevigLEPP3/CEt5sbxqFqppmFmCrFK0T2LeNo9X?=
 =?us-ascii?Q?OmcDUH/a9Tqv0cnKbLIWptARFSkCPH3KtZZkdnED1k/8HqXBJtmQD2iQgIfR?=
 =?us-ascii?Q?HiM1SPhKX1qfHgVN6Y1of38EywBto1es5E0r8CtTGEhT0KTYIqPe0/j/IPKf?=
 =?us-ascii?Q?UECs9bi9J49lbRXI27/j4aB3cyD+gYqft1kX//s+39W3GGEqqt4Rpu4wXaSq?=
 =?us-ascii?Q?Q0aIxMZbFEmW7uXS3a4bM2PCFAEWJEcrMfTYbMKBDvTgrfoUdCf5Dl2NCRLx?=
 =?us-ascii?Q?JD5aWozKXrG+eTPZUHOmd9swB0Vc06IwKwg475SH0YHNG76mBfj3Agt6RMWZ?=
 =?us-ascii?Q?5vcGH2Oue9Yn9w2AOGPnoXy9QCkRhAD76zNZoUuydumhLGpMU9W8Egj+tWYJ?=
 =?us-ascii?Q?09tiLUdIWSbzWO2EB8AjLp9Zy7EmYsrg9rKpk0xxTmyxPHTri+MEj5aBhnUA?=
 =?us-ascii?Q?9ObTcwQNkwM5I7tb8a11VDHyxjt/eg3UfxHNDfQiKYYq7mcbYISBphD2eT2O?=
 =?us-ascii?Q?ttzo+E0k4fqypyeQDS4xR+xTmcIG9YqTORK09/sfWIbweOxyg+Vs18vHd8va?=
 =?us-ascii?Q?wxoTXqgArcs94NJuf34FJ1SxgK4i9pXFP4HFgxxssvPQxtWm2RK+NznCL9ft?=
 =?us-ascii?Q?J0XjtDz+/Nfp8s2JRvk35FXmulYy7V3GxwumWk4Sf3bjl/rOyzHZRjrnAi7X?=
 =?us-ascii?Q?gteGjeahNbiRwwY3iTXIj8ZzftRryVd9b1ywVTSlD14AR7Jdua2zjciG9Sz7?=
 =?us-ascii?Q?lCbO1htsTZB2jwV1o4yvq9cBvUmGcS/E1OqgdsS+oaJS7cnrU8iUfrNsprqC?=
 =?us-ascii?Q?02SGJ4VwhztF5V3NdZ3YRYLNtT2kW91HZAGJzZCVReeWbow2hh7hwY7QrN1G?=
 =?us-ascii?Q?Ew=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: analog.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR03MB6253.namprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1497f88b-1ace-497a-d1e2-08da8f34574f
X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Sep 2022 11:46:59.2110
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: eaa689b4-8f87-40e0-9c6f-7228de4d754a
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: kb7OA+oJw1UXM1fkmMtJy4x/nz30SjlWdaZI/eZCT/3zX6aD1cMtzEb1F5HN+GsutwK8P4JrXnSJ8QBFXjHJ9UKMhEoqJNUQAsKDlYIEpOg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR03MB6946
X-Proofpoint-GUID: YJOd0MfKyf_AJR-DqYLw0wA4cvEjFoKv
X-Proofpoint-ORIG-GUID: L799wMmdlbP3bsQ-I5UrE0LvzcpqOC3D
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-09-05_08,2022-09-05_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0
 bulkscore=0 phishscore=0 clxscore=1015 impostorscore=0 mlxscore=0
 spamscore=0 mlxlogscore=999 suspectscore=0 adultscore=0 malwarescore=0
 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2207270000 definitions=main-2209050057
X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> -----Original Message-----
> From: Wei Yongjun <weiyongjun1@huawei.com>
> Sent: Samstag, 27. August 2022 09:32
> To: Hennerich, Michael <Michael.Hennerich@analog.com>; Sebastian
> Reichel <sre@kernel.org>
> Cc: Wei Yongjun <weiyongjun1@huawei.com>; linux-pm@vger.kernel.org;
> linux-kernel@vger.kernel.org
> Subject: [PATCH -next 1/2] power: supply: adp5061: fix out-of-bounds read=
 in
> adp5061_get_chg_type()
>=20
>=20
> ADP5061_CHG_STATUS_1_CHG_STATUS is masked with 0x07, which means
> a length of 8, but adp5061_chg_type array size is 4, may end up reading 4
> elements beyond the end of the adp5061_chg_type[] array.
>=20
> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>

Acked-by: Michael Hennerich <michael.hennerich@analog.com>

> ---
>  drivers/power/supply/adp5061.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>=20
> diff --git a/drivers/power/supply/adp5061.c
> b/drivers/power/supply/adp5061.c index 003557043ab3..daee1161c305
> 100644
> --- a/drivers/power/supply/adp5061.c
> +++ b/drivers/power/supply/adp5061.c
> @@ -427,11 +427,11 @@ static int adp5061_get_chg_type(struct
> adp5061_state *st,
>  	if (ret < 0)
>  		return ret;
>=20
> -	chg_type =3D
> adp5061_chg_type[ADP5061_CHG_STATUS_1_CHG_STATUS(status1)];
> -	if (chg_type > ADP5061_CHG_FAST_CV)
> +	chg_type =3D ADP5061_CHG_STATUS_1_CHG_STATUS(status1);
> +	if (chg_type >=3D ARRAY_SIZE(adp5061_chg_type))
>  		val->intval =3D POWER_SUPPLY_STATUS_UNKNOWN;
>  	else
> -		val->intval =3D chg_type;
> +		val->intval =3D adp5061_chg_type[chg_type];
>=20
>  	return ret;
>  }
> --
> 2.34.1