diff options
| author | Imre Sunyi <imre.sunyi@sonymobile.com> | 2014-09-12 15:39:43 +0200 |
|---|---|---|
| committer | Sean Wan <swan@google.com> | 2014-09-16 13:40:59 -0700 |
| commit | 23c635f667ad2b10335b68ce857d8cf4fc4da1c1 (patch) | |
| tree | bec2d85959d2030b2c60c237d8933484e4e12d79 | |
| parent | bae926a835ac0bb033237134ce4d3a6ff3a7e4c1 (diff) | |
| download | bcm-23c635f667ad2b10335b68ce857d8cf4fc4da1c1.tar.gz | |
mfd: bcmpmu59xxx-accy-core: Prevent array overflow
When calling bcmpmu_get_next_trim_curr() the logic assumed that
an increment in register resulted in next higher current trim setting.
HW has it in two's complement format. Register value 0x1F corresponds
to -5% and register value 0x00 corresponds to -3% which is the next
higher setting.
When already on the highest possible trim setting return the
highest possible value for the data type the function can return.
[bug: 17511445]
Change-Id: I4506da818dff829bbfc04e25432b0b85b13e89a0
| -rw-r--r-- | drivers/mfd/bcmpmu59xxx-accy-core.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/mfd/bcmpmu59xxx-accy-core.c b/drivers/mfd/bcmpmu59xxx-accy-core.c index 12a0264e0a9..73057f7f83f 100644 --- a/drivers/mfd/bcmpmu59xxx-accy-core.c +++ b/drivers/mfd/bcmpmu59xxx-accy-core.c @@ -1430,11 +1430,15 @@ int bcmpmu_get_next_trim_curr(struct bcmpmu59xxx *bcmpmu, int add) { int curr; int icc_fc; + int next_trim; u8 trim = 0; icc_fc = bcmpmu_get_icc_fc(bcmpmu); trim = bcmpmu_get_cc_trim(bcmpmu); - curr = ((icc_fc * (trim_to_per[trim + 1].perc + add)) / 100); + next_trim = __get_cc_trim_up_reg(trim); + if (next_trim < 0) + return INT_MAX; + curr = ((icc_fc * (trim_to_per[next_trim].perc + add)) / 100); return curr; } |