Hi all,

I wanted to first share a summary of possible off-by-one bugs and confirm these are real fixes worth posting.

I wrote a smatch check to complain if max_register is a power of 2, and have reviewed the warnings. I think the below warnings are true positives.

regmap_config.max_register is inclusive (it is the highest valid register address), not a register count.

The drivers below currently use + 1, which allows one invalid extra register address.

sound/soc/codecs/rt1305.c

static const struct regmap_config rt1305_regmap = {
        .reg_bits = 8,
        .val_bits = 16,
        .max_register = RT1305_MAX_REG + 1 + (ARRAY_SIZE(rt1305_ranges) *
                                               RT1305_PR_SPACING),

Values: 0xff + 1 + (1 * 0x100) = 0x200

I think the correct value is 0xff + (1 * 0x100) = 0x1ff

There are similar issues in other
  - sound/soc/codecs/rt1305.c
  - sound/soc/codecs/rt5616.c
  - sound/soc/codecs/rt5640.c
  - sound/soc/codecs/rt5645.c
  - sound/soc/codecs/rt5651.c
  - sound/soc/codecs/rt5660.c
  - sound/soc/codecs/rt5670.c
  - sound/soc/codecs/rt5677.c

So I thought of checking here if these need fixing before making patches.

Note: these are purely based on static analysis and can't really test these.


Thanks,
Harshit

Reply via email to