This is a note to let you know that I've just added the patch titled regulator: core: Prevent integer underflow to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: regulator-core-prevent-integer-underflow.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit 1225e902195ea6ccd83062ef801fc01c833468d6 Author: Patrick Rudolph <patrick.rudolph@xxxxxxxxxxxxx> Date: Fri Sep 9 14:59:53 2022 +0200 regulator: core: Prevent integer underflow [ Upstream commit 8d8e16592022c9650df8aedfe6552ed478d7135b ] By using a ratio of delay to poll_enabled_time that is not integer time_remaining underflows and does not exit the loop as expected. As delay could be derived from DT and poll_enabled_time is defined in the driver this can easily happen. Use a signed iterator to make sure that the loop exits once the remaining time is negative. Signed-off-by: Patrick Rudolph <patrick.rudolph@xxxxxxxxxxxxx> Link: https://lore.kernel.org/r/20220909125954.577669-1-patrick.rudolph@xxxxxxxxxxxxx Signed-off-by: Mark Brown <broonie@xxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c index 43613db7af75..aa4d78b02483 100644 --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -2636,7 +2636,7 @@ static int _regulator_do_enable(struct regulator_dev *rdev) * expired, return -ETIMEDOUT. */ if (rdev->desc->poll_enabled_time) { - unsigned int time_remaining = delay; + int time_remaining = delay; while (time_remaining > 0) { _regulator_enable_delay(rdev->desc->poll_enabled_time);