From f30ab4d58bfe498338807dba3c131f13f9d6517a Mon Sep 17 00:00:00 2001 From: chailu1 Date: Fri, 15 Nov 2019 14:05:33 +0800 Subject: [PATCH] Charge:fix slab out of bounds risk There is a risk if enum mmi_temp_zones value > num_temp_zones. This will casue pointer point to a illegal memory address. Change-Id: Ifa68a3b5325063d07a3ccddbb8636644a58fe1c6 Reviewed-on: https://gerrit.mot.com/1456222 SME-Granted: SME Approvals Granted SLTApproved: Slta Waiver Tested-by: Jira Key Reviewed-by: Hongshu Lou Reviewed-by: Haijian Ma Reviewed-by: Huosheng Liao Submit-Approved: Jira Key --- drivers/power/qpnp-smbcharger-mmi/qpnp-smbcharger-mmi.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/power/qpnp-smbcharger-mmi/qpnp-smbcharger-mmi.c b/drivers/power/qpnp-smbcharger-mmi/qpnp-smbcharger-mmi.c index 35c1942c09fc..11562c0e042a 100644 --- a/drivers/power/qpnp-smbcharger-mmi/qpnp-smbcharger-mmi.c +++ b/drivers/power/qpnp-smbcharger-mmi/qpnp-smbcharger-mmi.c @@ -2550,7 +2550,10 @@ static void mmi_basic_charge_sm(struct smb_mmi_charger *chip, max_fv_mv = chip->base_fv_mv; mmi_find_temp_zone(chip, prm, stat->batt_temp); - zone = &prm->temp_zones[prm->pres_temp_zone]; + if (prm->pres_temp_zone >= chip->num_temp_zones) + zone = &prm->temp_zones[0]; + else + zone = &prm->temp_zones[prm->pres_temp_zone]; if (!stat->charger_present && !is_wls_online(chip)) { prm->pres_chrg_step = STEP_NONE;