From 2c3d417c78c414dd6f296ac959afd1ffb4c836cf Mon Sep 17 00:00:00 2001 From: chailu1 Date: Mon, 18 Nov 2019 16:46:09 +0800 Subject: [PATCH] Charge:fix slab out of bounds risk There is a risk if enum mmi_temp_zones value > num_temp_zones. This will casue pointer point to a illegal memory address. Change-Id: Ib34f471d55e7b68e8cf11ec07ede19fbf5f22815 Signed-off-by: chailu1 Reviewed-on: https://gerrit.mot.com/1456934 SLTApproved: Slta Waiver SME-Granted: SME Approvals Granted Tested-by: Jira Key Reviewed-by: Haijian Ma Reviewed-by: Huosheng Liao Submit-Approved: Jira Key --- drivers/power/qpnp-smbcharger-mmi/qpnp-smbcharger-mmi.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/power/qpnp-smbcharger-mmi/qpnp-smbcharger-mmi.c b/drivers/power/qpnp-smbcharger-mmi/qpnp-smbcharger-mmi.c index 471c281b1b5f..cdbf486a8361 100644 --- a/drivers/power/qpnp-smbcharger-mmi/qpnp-smbcharger-mmi.c +++ b/drivers/power/qpnp-smbcharger-mmi/qpnp-smbcharger-mmi.c @@ -2550,7 +2550,10 @@ static void mmi_basic_charge_sm(struct smb_mmi_charger *chip, max_fv_mv = chip->base_fv_mv; mmi_find_temp_zone(chip, prm, stat->batt_temp); - zone = &prm->temp_zones[prm->pres_temp_zone]; + if (prm->pres_temp_zone >= prm->num_temp_zones) + zone = &prm->temp_zones[0]; + else + zone = &prm->temp_zones[prm->pres_temp_zone]; if (!stat->charger_present && !is_wls_online(chip)) { prm->pres_chrg_step = STEP_NONE;