regcache: flat: Require max_registers to be set

If max_register is unset, regcache_flat_get_index will return 0 and only
memory for 1 unsigned int will be allocated, resulting in writing out
of bounds.

Signed-off-by: Alexander Stein <[email protected]>
Signed-off-by: Mark Brown <[email protected]>

diff --git a/drivers/base/regmap/regcache-flat.c b/drivers/base/regmap/regcache-flat.c
index 3ee72550b1e3b4ddc8cbaae9c89d0f39778da6d3..4d2e50bfc7263c689fd6e575850e5fbf4b517e1a 100644 (file)
--- a/drivers/base/regmap/regcache-flat.c
+++ b/drivers/base/regmap/regcache-flat.c
@@ -27,7 +27,7 @@ static int regcache_flat_init(struct regmap *map)
        int i;
        unsigned int *cache;
 
        int i;
        unsigned int *cache;
 

-       if (!map || map->reg_stride_order < 0)
+       if (!map || map->reg_stride_order < 0 || !map->max_register)

                return -EINVAL;
 
        map->cache = kcalloc(regcache_flat_get_index(map, map->max_register)
                return -EINVAL;
 
        map->cache = kcalloc(regcache_flat_get_index(map, map->max_register)