power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()

ADP5061_CHG_STATUS_1_CHG_STATUS is masked with 0x07, which means a length
of 8, but adp5061_chg_type array size is 4, may end up reading 4 elements
beyond the end of the adp5061_chg_type[] array.

Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Acked-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>

diff --git a/drivers/power/supply/adp5061.c b/drivers/power/supply/adp5061.c
index 003557043ab3afa5a35ee4babf3f797476af2e6c..daee1161c3059cf2bfb9c30639d5b64dd119b09c 100644 (file)
--- a/drivers/power/supply/adp5061.c
+++ b/drivers/power/supply/adp5061.c
@@ -427,11 +427,11 @@ static int adp5061_get_chg_type(struct adp5061_state *st,
        if (ret < 0)
                return ret;
 
-       chg_type = adp5061_chg_type[ADP5061_CHG_STATUS_1_CHG_STATUS(status1)];
-       if (chg_type > ADP5061_CHG_FAST_CV)
+       chg_type = ADP5061_CHG_STATUS_1_CHG_STATUS(status1);
+       if (chg_type >= ARRAY_SIZE(adp5061_chg_type))
                val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
        else
-               val->intval = chg_type;
+               val->intval = adp5061_chg_type[chg_type];
 
        return ret;
 }