This is a note to let you know that I've just added the patch titled regulator: core: Prevent integer underflow to the 6.0-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: regulator-core-prevent-integer-underflow.patch and it can be found in the queue-6.0 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit d7740e912ea491036bcf05a82616b1a9448b7a93 Author: Patrick Rudolph <patrick.rudolph@xxxxxxxxxxxxx> Date: Fri Sep 9 14:59:53 2022 +0200 regulator: core: Prevent integer underflow [ Upstream commit 8d8e16592022c9650df8aedfe6552ed478d7135b ] By using a ratio of delay to poll_enabled_time that is not integer time_remaining underflows and does not exit the loop as expected. As delay could be derived from DT and poll_enabled_time is defined in the driver this can easily happen. Use a signed iterator to make sure that the loop exits once the remaining time is negative. Signed-off-by: Patrick Rudolph <patrick.rudolph@xxxxxxxxxxxxx> Link: https://lore.kernel.org/r/20220909125954.577669-1-patrick.rudolph@xxxxxxxxxxxxx Signed-off-by: Mark Brown <broonie@xxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c index d3e8dc32832d..c3871565fd7d 100644 --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -2681,7 +2681,7 @@ static int _regulator_do_enable(struct regulator_dev *rdev) * return -ETIMEDOUT. */ if (rdev->desc->poll_enabled_time) { - unsigned int time_remaining = delay; + int time_remaining = delay; while (time_remaining > 0) { _regulator_delay_helper(rdev->desc->poll_enabled_time);