regulator: fan53555: Check pdata->slew_rate setting

Current code does not really avoid array access out of bounds,
fix it by add checking for pdata->slew_rate.
If pdata->slew_rate is too big, it's a bug in pdata that needs fix.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/drivers/regulator/fan53555.c b/drivers/regulator/fan53555.c
index d7142352f6bcaa08f895a07279019a3d8d60f14d..771a06d1900db533e80221780c97dea176c7fb75 100644 (file)
--- a/drivers/regulator/fan53555.c
+++ b/drivers/regulator/fan53555.c
@@ -490,11 +490,13 @@ static int fan53555_regulator_probe(struct i2c_client *client,
        } else {
                /* if no ramp constraint set, get the pdata ramp_delay */
                if (!di->regulator->constraints.ramp_delay) {
-                       int slew_idx = (pdata->slew_rate & 0x7)
-                                               ? pdata->slew_rate : 0;
+                       if (pdata->slew_rate >= ARRAY_SIZE(slew_rates)) {
+                               dev_err(&client->dev, "Invalid slew_rate\n");
+                               return -EINVAL;
+                       }
 
                        di->regulator->constraints.ramp_delay
-                                               = slew_rates[slew_idx];
+                                       = slew_rates[pdata->slew_rate];
                }
 
                di->vendor = id->driver_data;