Commit f00e7109 authored by Dan Carpenter's avatar Dan Carpenter Committed by Mark Brown

regmap: Fix reversed bounds check in regmap_raw_write()

We're supposed to be checking that "val_len" is not too large but
instead we check if it is smaller than the max.

The only function affected would be regmap_i2c_smbus_i2c_write() in
drivers/base/regmap/regmap-i2c.c.  Strangely that function has its own
limit check which returns an error if (count >= I2C_SMBUS_BLOCK_MAX) so
it doesn't look like it has ever been able to do anything except return
an error.

Fixes: c335931e ("regmap: Add raw_write/read checks for max_raw_write/read sizes")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
parent a75de772
...@@ -1831,7 +1831,7 @@ int regmap_raw_write(struct regmap *map, unsigned int reg, ...@@ -1831,7 +1831,7 @@ int regmap_raw_write(struct regmap *map, unsigned int reg,
return -EINVAL; return -EINVAL;
if (val_len % map->format.val_bytes) if (val_len % map->format.val_bytes)
return -EINVAL; return -EINVAL;
if (map->max_raw_write && map->max_raw_write > val_len) if (map->max_raw_write && map->max_raw_write < val_len)
return -E2BIG; return -E2BIG;
map->lock(map->lock_arg); map->lock(map->lock_arg);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment