Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755428Ab1EPUTP (ORCPT ); Mon, 16 May 2011 16:19:15 -0400 Received: from mail-wy0-f174.google.com ([74.125.82.174]:57574 "EHLO mail-wy0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752549Ab1EPUTO (ORCPT ); Mon, 16 May 2011 16:19:14 -0400 Subject: Re: [PATCH RESEND] mfd: Fix off-by-one value range checking for tps65910_i2c_write From: Liam Girdwood To: Axel Lin Cc: linux-kernel@vger.kernel.org, Graeme Gregory , Jorge Eduardo Candelaria , Samuel Ortiz In-Reply-To: <1305555542.2337.3.camel@phoenix> References: <1305555542.2337.3.camel@phoenix> Content-Type: text/plain; charset="UTF-8" Date: Mon, 16 May 2011 21:19:10 +0100 Message-ID: <1305577150.3156.14.camel@odin> Mime-Version: 1.0 X-Mailer: Evolution 2.32.2 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1039 Lines: 31 On Mon, 2011-05-16 at 22:19 +0800, Axel Lin wrote: > If bytes == (TPS65910_MAX_REGISTER + 1), we have a buffer overflow when > doing memcpy(&msg[1], src, bytes). > > Signed-off-by: Axel Lin > Acked-by: Samuel Ortiz > --- > drivers/mfd/tps65910.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c > index bf649cf..e318248 100644 > --- a/drivers/mfd/tps65910.c > +++ b/drivers/mfd/tps65910.c > @@ -71,7 +71,7 @@ static int tps65910_i2c_write(struct tps65910 *tps65910, u8 reg, > u8 msg[TPS65910_MAX_REGISTER + 1]; > int ret; > > - if (bytes > (TPS65910_MAX_REGISTER + 1)) > + if (bytes > TPS65910_MAX_REGISTER) > return -EINVAL; > > msg[0] = reg; Applied. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/