Hi Grant,

There is a memory corruption bug in 176f9f29cec9 "STAGING:iio:light:
fix ISL29018 init to handle brownout".

In isl29018_chip_init() we call:
        status = isl29018_write_data(client, ISL29018_REG_TEST, 0,              
 
                                ISL29018_TEST_MASK, ISL29018_TEST_SHIFT);       
 

where ISL29018_REG_TEST is 8.

In isl29018_write_data() it uses reg (ISL29018_REG_TEST) as the
offset into the ->reg_cache[] array:
        chip->reg_cache[reg] = regval;

But ->reg_cache[] only has 3 elements, so we're past the end of the
array.

I don't know the code well enough to fix this.

regards,
dan carpenter
_______________________________________________
devel mailing list
[email protected]
http://driverdev.linuxdriverproject.org/mailman/listinfo/devel

Reply via email to