On Mon, Aug 22, 2022 at 12:25 PM Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
> drivers/base/regmap/regmap.c
> 2132 static int regmap_noinc_readwrite(struct regmap *map, unsigned int reg,
> 2133 void *val, unsigned int val_len, bool write)
> 2134 {
> 2135 size_t val_bytes = map->format.val_bytes;
> 2136 size_t val_count = val_len / val_bytes;
>
> val_len is bytes. val_count is elements.
Correct
> 2194 if (!ret && regmap_should_log(map)) {
> 2195 dev_info(map->dev, "%x %s [", reg, write ? "<=" : "=>");
> 2196 for (i = 0; i < val_len; i++) {
> ^^^^^^^
> This should be val_count or it will beyond the end of the arrays.
>
> 2197 switch (val_bytes) {
> 2198 case 1:
> 2199 pr_cont("%x", u8p[i]);
> 2200 break;
> 2201 case 2:
> --> 2202 pr_cont("%x", u16p[i]);
> 2203 break;
> 2204 case 4:
> 2205 pr_cont("%x", u32p[i]);
> 2206 break;
> 2207 #ifdef CONFIG_64BIT
> 2208 case 8:
> 2209 pr_cont("%llx", u64p[i]);
> 2210 break;
> 2211 #endif
> 2212 default:
> 2213 break;
> 2214 }
> 2215 if (i == (val_len - 1))
> ^^^^^^^
> val_count as well probably?
Good catch, I'll send a patch!
Yours,
Linus Walleij
