From: Axel Lin <axel.lin@gmail.com> Date: Mon, 16 May 2011 14:19:01 +0000 (+0800) Subject: mfd: Fix off-by-one value range checking for tps65910_i2c_write X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=0514e9acd7655c708fbf12a659ea43d835bc688a;p=openwrt%2Fstaging%2Fblogic.git mfd: Fix off-by-one value range checking for tps65910_i2c_write If bytes == (TPS65910_MAX_REGISTER + 1), we have a buffer overflow when doing memcpy(&msg[1], src, bytes). Signed-off-by: Axel Lin <axel.lin@gmail.com> Acked-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk> --- diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c index bf649cf6a0ae..e31824870b9f 100644 --- a/drivers/mfd/tps65910.c +++ b/drivers/mfd/tps65910.c @@ -71,7 +71,7 @@ static int tps65910_i2c_write(struct tps65910 *tps65910, u8 reg, u8 msg[TPS65910_MAX_REGISTER + 1]; int ret; - if (bytes > (TPS65910_MAX_REGISTER + 1)) + if (bytes > TPS65910_MAX_REGISTER) return -EINVAL; msg[0] = reg;