The for loop in se_desc uses i as the loop index and also to cause the loop to end if the passed in name is not found. However i is not incremented which could cause the loop to continue indefinitely and access out of bounds memory. Add an increment of i to ensure that the loop terminates correctly in the case where name is not found.
This issue found by Smatch. Signed-off-by: Andrew Goodbody <andrew.goodb...@linaro.org> --- drivers/power/regulator/pfuze100.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/power/regulator/pfuze100.c b/drivers/power/regulator/pfuze100.c index bf3a7019411..eff166b368b 100644 --- a/drivers/power/regulator/pfuze100.c +++ b/drivers/power/regulator/pfuze100.c @@ -247,7 +247,7 @@ static struct pfuze100_regulator_desc *se_desc(struct pfuze100_regulator_desc *d { int i; - for (i = 0; i < size; desc++) { + for (i = 0; i < size; i++, desc++) { if (!strcmp(desc->name, name)) return desc; continue; --- base-commit: 7027b445cc0bfb86204ecb1f1fe596f5895048d9 change-id: 20250703-pfuze100_fix-4a0a1c3084cf Best regards, -- Andrew Goodbody <andrew.goodb...@linaro.org>