The for loop in se_desc uses i as the loop index and also to cause the
loop to end if the passed in name is not found. However i is not
incremented which could cause the loop to continue indefinitely and
access out of bounds memory.
Add an increment of i to ensure that the loop terminates correctly in
the case where name is not found.

This issue found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodb...@linaro.org>
---
 drivers/power/regulator/pfuze100.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/regulator/pfuze100.c 
b/drivers/power/regulator/pfuze100.c
index bf3a7019411..eff166b368b 100644
--- a/drivers/power/regulator/pfuze100.c
+++ b/drivers/power/regulator/pfuze100.c
@@ -247,7 +247,7 @@ static struct pfuze100_regulator_desc *se_desc(struct 
pfuze100_regulator_desc *d
 {
        int i;
 
-       for (i = 0; i < size; desc++) {
+       for (i = 0; i < size; i++, desc++) {
                if (!strcmp(desc->name, name))
                        return desc;
                continue;

---
base-commit: 7027b445cc0bfb86204ecb1f1fe596f5895048d9
change-id: 20250703-pfuze100_fix-4a0a1c3084cf

Best regards,
-- 
Andrew Goodbody <andrew.goodb...@linaro.org>

Reply via email to