linux/drivers/power/supply
Dorian Rudolph 093d27bb6f power: supply: core: Fix boundary conditions in interpolation
The functions power_supply_temp2resist_simple and power_supply_ocv2cap_simple
handle boundary conditions incorrectly.
The change was introduced in a4585ba205
("power: supply: core: Use library interpolation").
There are two issues: First, the lines "high = i - 1" and "high = i" in ocv2cap
have the wrong order compared to temp2resist. As a consequence, ocv2cap
sets high=-1 if ocv>table[0].ocv, which causes an out-of-bounds read.
Second, the logic of temp2resist is also not correct.
Consider the case table[] = {{20, 100}, {10, 80}, {0, 60}}.
For temp=5, we expect a resistance of 70% by interpolation.
However, temp2resist sets high=low=2 and returns 60.

Cc: stable@vger.kernel.org
Signed-off-by: Dorian Rudolph <mail@dorianrudolph.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Fixes: a4585ba205 ("power: supply: core: Use library interpolation")
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2022-06-09 21:08:38 +02:00
..
88pm860x_battery.c power: supply: 88pm860x_battery: Remove unnecessary int for long long 2021-04-02 14:14:58 +02:00
88pm860x_charger.c
ab8500_bmdata.c power: supply: ab8500: Standardize BTI resistance 2022-02-28 11:34:31 +01:00
ab8500_btemp.c power: supply: ab8500: Standardize BTI resistance 2022-02-28 11:34:31 +01:00
ab8500_chargalg.c power: ab8500_chargalg: Use CLOCK_MONOTONIC 2022-03-14 17:24:52 +01:00
ab8500_charger.c Driver core changes for 5.18-rc1 2022-03-28 12:41:28 -07:00
ab8500_fg.c power: supply: ab8500_fg: add missing destroy_workqueue in ab8500_fg_probe 2022-06-09 21:08:06 +02:00
ab8500-bm.h power: supply: ab8500: Standardize BTI resistance 2022-02-28 11:34:31 +01:00
ab8500-chargalg.h power: supply: ab8500: Standardize CV voltage 2021-11-22 17:16:26 +01:00
acer_a500_battery.c power: supply: Add battery gauge driver for Acer Iconia Tab A500 2021-01-14 23:39:43 +01:00
act8945a_charger.c power: supply: act8945a: correct kerneldoc 2021-04-20 16:18:08 +02:00
adp5061.c
apm_power.c
axp20x_ac_power.c power: supply: axp20x_ac_power: fix platform_get_irq.cocci warning 2022-03-04 22:20:32 +01:00
axp20x_battery.c power: supply: axp20x_battery: properly report current when discharging 2022-02-01 11:18:47 +01:00
axp20x_usb_power.c power: supply: axp20x_usb_power: fix platform_get_irq.cocci warnings 2022-03-04 22:20:32 +01:00
axp288_charger.c extcon: Fix extcon_get_extcon_dev() error handling 2022-05-13 17:03:40 +09:00
axp288_fuel_gauge.c power: supply: axp288_fuel_gauge: Drop BIOS version check from "T3 MRD" DMI quirk 2022-05-03 17:01:53 +02:00
bd99954-charger.c power: supply_core: Pass pointer to battery info 2022-01-03 18:53:10 +01:00
bd99954-charger.h power: supply: Support ROHM bd99954 charger 2020-05-10 02:35:49 +02:00
bq27xxx_battery_hdq.c power supply and reset changes for the v5.10 series 2020-10-20 10:56:34 -07:00
bq27xxx_battery_i2c.c power: supply: bq27xxx: Fix kernel crash on IRQ handler register error 2021-11-02 13:47:19 +01:00
bq27xxx_battery.c power: supply: bq27xxx: expose battery data when CI=1 2022-05-04 23:44:03 +02:00
bq256xx_charger.c power: supply: bq256xx: Handle OOM correctly 2022-02-11 21:19:51 +01:00
bq2415x_charger.c power: supply: bq2xxxx: Replace HTTP links with HTTPS ones 2020-07-28 02:07:35 +02:00
bq2515x_charger.c power: supply_core: Pass pointer to battery info 2022-01-03 18:53:10 +01:00
bq24190_charger.c power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync 2022-05-04 23:44:03 +02:00
bq24257_charger.c power: supply: bq24257: skip 'struct acpi_device_id' when !CONFIG_ACPI 2020-10-03 22:17:50 +02:00
bq24735-charger.c power: supply: bq24735: reorganize ChargeOption command macros 2021-08-13 18:38:17 +02:00
bq25890_charger.c power: supply: bq25890: Use the devm_regmap_field_bulk_alloc() helper 2022-02-01 14:55:12 +01:00
bq25980_charger.c power: supply: bq25980: Implements POWER_SUPPLY_CHARGE_TYPE_BYPASS 2022-02-24 12:09:20 +01:00
bq25980_charger.h power: supply: bq25980: Add support for the BQ259xx family 2020-10-04 01:54:35 +02:00
charger-manager.c extcon: Fix extcon_get_extcon_dev() error handling 2022-05-13 17:03:40 +09:00
collie_battery.c power: supply: collie_battery: Convert to GPIO descriptors 2020-11-30 02:18:49 +01:00
cpcap-battery.c power: supply: cpcap-battery: Add battery type auto detection for mapphone devices 2022-02-01 12:47:11 +01:00
cpcap-charger.c power: supply: cpcap-charger: get the battery inserted infomation from cpcap-battery 2021-06-04 14:36:17 +02:00
cros_peripheral_charger.c power: supply: PCHG: Use MKBP for device event handling 2022-02-13 22:20:12 +01:00
cros_usbpd-charger.c power: supply: cros_usbpd: Use struct_size() helper in kzalloc() 2022-01-31 22:42:25 +01:00
cw2015_battery.c power: supply: core: fix application of sizeof to pointer 2022-02-01 13:13:44 +01:00
da9030_battery.c power: Convert to DEFINE_SHOW_ATTRIBUTE 2020-07-27 00:05:56 +02:00
da9052-battery.c
da9150-charger.c
da9150-fg.c power: supply: da9150-fg: Remove unnecessary print function dev_err() 2022-03-04 22:20:33 +01:00
ds2760_battery.c power-supply: use kobj_to_dev() 2021-01-28 01:31:42 +01:00
ds2780_battery.c power: supply: ds2780: Switch to using the new API kobj_to_dev() 2021-01-16 12:36:26 +01:00
ds2781_battery.c power: supply: ds2781: use kobj_to_dev() 2021-03-22 15:05:41 +01:00
ds2782_battery.c
generic-adc-battery.c power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() 2021-04-08 14:35:19 +02:00
goldfish_battery.c power: supply: goldfish: skip 'struct acpi_device_id' when !CONFIG_ACPI 2020-10-03 22:17:50 +02:00
gpio-charger.c power: supply: gpio-charger: add charge-current-limit feature 2020-08-27 21:13:23 +02:00
ingenic-battery.c power: supply_core: Pass pointer to battery info 2022-01-03 18:53:10 +01:00
ip5xxx_power.c power: supply: Add a driver for Injoinic power bank ICs 2022-03-04 22:33:00 +01:00
ipaq_micro_battery.c power: supply: ipaq_micro_battery: remove unneeded semicolon 2020-01-17 02:13:00 +01:00
isp1704_charger.c change email address for Pali Rohár 2020-04-10 15:36:22 -07:00
Kconfig power: supply: Add a driver for Injoinic power bank ICs 2022-03-04 22:33:00 +01:00
lego_ev3_battery.c power: supply: lego_ev3: Simplify with dev_err_probe() 2020-08-26 17:25:45 +02:00
lp8727_charger.c
lp8788-charger.c power: supply: Use IRQF_ONESHOT 2021-03-22 14:54:24 +01:00
lt3651-charger.c
ltc2941-battery-gauge.c power: supply: ltc2941: clean up error messages 2022-02-13 22:21:42 +01:00
ltc4162-l-charger.c power: supply: ltc4162-l: Constify static struct attribute_group 2021-01-13 22:11:43 +01:00
Makefile power: supply: Add a driver for Injoinic power bank ICs 2022-03-04 22:33:00 +01:00
max1721x_battery.c power: supply: max1721x: Correct spelling 2021-03-22 15:11:22 +01:00
max8903_charger.c power: supply: max8903: Convert to GPIO descriptors 2021-01-12 23:23:49 +01:00
max8925_power.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
max8997_charger.c extcon: Fix extcon_get_extcon_dev() error handling 2022-05-13 17:03:40 +09:00
max8998_charger.c power: supply: max8998_charger: Correct ONLINE and add STATUS props 2020-06-19 19:58:23 +02:00
max14577_charger.c power: supply: max14577: remove unneeded variable initialization 2021-04-20 16:18:08 +02:00
max14656_charger_detector.c power: supply: max14656: Use devm_work_autocancel() 2022-02-24 12:19:20 +01:00
max17040_battery.c power: supply: max17040: fix null-ptr-deref in max17040_probe() 2021-10-12 17:18:46 +02:00
max17042_battery.c power: supply: max17042_battery: Use devm_work_autocancel() 2022-02-24 12:00:14 +01:00
max77650-charger.c
max77693_charger.c
max77976_charger.c power: supply: max77976: add Maxim MAX77976 charger driver 2021-11-16 16:10:07 +01:00
mp2629_charger.c power: supply: mp2629_charger: use platform_get_irq() 2022-02-01 10:32:35 +01:00
mt6360_charger.c power: supply: mt6360_charger: add MT6360 charger support 2021-08-13 18:37:49 +02:00
olpc_battery.c power: supply: olpc_battery: fix the power supply name 2020-05-10 18:56:30 +02:00
pcf50633-charger.c
pda_power.c
pm2301_charger.h
pmu_battery.c
power_supply_core.c power: supply: core: Fix boundary conditions in interpolation 2022-06-09 21:08:38 +02:00
power_supply_hwmon.c power: supply: core: Simplify hwmon memory allocation 2022-02-11 19:45:52 +01:00
power_supply_leds.c
power_supply_sysfs.c power: supply: Introduces bypass charging property 2022-02-24 12:09:20 +01:00
power_supply.h
qcom_smbb.c power: supply: qcom_smbb: support pm8226 2021-11-30 11:34:27 +01:00
rn5t618_power.c power: supply: rn5t618: Add voltage_now property 2021-08-13 18:38:17 +02:00
rt5033_battery.c power: supply: rt5033_battery: Change voltage values to µV 2021-10-12 17:12:23 +02:00
rt9455_charger.c power: supply: rt9455: Don't pass an error code in remove callback 2022-02-11 19:52:56 +01:00
rx51_battery.c change email address for Pali Rohár 2020-04-10 15:36:22 -07:00
s3c_adc_battery.c power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() 2021-04-08 14:36:08 +02:00
samsung-sdi-battery.c power: supply: samsung-sdi-battery: Add missing charge restart voltages 2022-04-13 12:05:22 +02:00
samsung-sdi-battery.h power: supply: Static data for Samsung batteries 2022-03-04 22:20:18 +01:00
sbs-battery.c power: supply: sbs-battery: add support for time_to_empty_now attribute 2021-08-06 23:48:51 +02:00
sbs-charger.c power: supply: sbs-charger: Don't cancel work that is not initialized 2022-02-24 12:16:21 +01:00
sbs-manager.c power: supply: sbs-manager: update gpio include 2021-04-02 14:19:26 +02:00
sc27xx_fuel_gauge.c power: supply_core: Pass pointer to battery info 2022-01-03 18:53:10 +01:00
sc2731_charger.c power: supply_core: Pass pointer to battery info 2022-01-03 18:53:10 +01:00
smb347-charger.c power: supply: Use an rbtree rather than flat register cache 2022-02-24 11:47:55 +01:00
surface_battery.c power: supply: surface_battery: Fix battery event handling 2021-05-13 18:26:07 +02:00
surface_charger.c power: supply: surface-charger: Fix type of integer variable 2021-06-03 20:53:54 +02:00
test_power.c power: supply: test-power: revise parameter printing to use sprintf 2020-10-09 01:02:30 +02:00
tosa_battery.c ARM/pxa/mfd/power/sound: Switch Tosa to GPIO descriptors 2022-05-07 22:55:33 +02:00
tps65090-charger.c power: supply: Use IRQF_ONESHOT 2021-03-22 14:54:24 +01:00
tps65217_charger.c power: supply: Use IRQF_ONESHOT 2021-03-22 14:54:24 +01:00
twl4030_charger.c power: twl4030: Use scnprintf() for avoiding potential buffer overflow 2020-03-11 23:20:32 +01:00
twl4030_madc_battery.c
ucs1002_power.c power: supply: ucs1002: fix some health status issues 2020-10-01 00:18:05 +02:00
ug3105_battery.c power: supply: ug3105_battery: Add driver for uPI uG3105 battery monitor 2022-02-11 19:08:35 +01:00
wilco-charger.c power: supply: wilco_ec: Add long life charging mode 2020-07-31 14:33:56 +02:00
wm97xx_battery.c power: supply: wm97xx_battery: Convert to GPIO descriptor 2021-01-13 22:25:07 +01:00
wm831x_backup.c
wm831x_power.c power: supply: wm831x_power: fix spelling mistake on function name 2021-10-02 17:31:15 +02:00
wm8350_power.c power: supply: wm8350-power: Add missing free in free_charger_irq 2022-03-04 22:20:32 +01:00
z2_battery.c power: supply: z2_battery: Drop unused variable 2021-03-15 00:08:07 +01:00