From: Andrew Scull <ascull@google.com>
Date: Sun, 3 Apr 2022 10:39:14 +0000 (+0000)
Subject: test: Fix pointer overrun in dm_test_devm_regmap()
X-Git-Tag: v2025.01-rc5-pxa1908~1427^2~1
X-Git-Url: http://git.dujemihanovic.xyz/img/%7B%7B%20%24image.RelPermalink%20%7D%7D?a=commitdiff_plain;h=7f58feae3fba07c349fe57e86ce8bd5cc2198f58;p=u-boot.git

test: Fix pointer overrun in dm_test_devm_regmap()

This tests calls regmap_read() which takes a uint pointer as an output
parameter. The test was passing a pointer to a u16 which resulted in an
overflow when the output was written. Fix this by following the
regmap_read() API and passing a uint pointer instead.

Signed-off-by: Andrew Scull <ascull@google.com>
Cc: Simon Glass <sjg@chromium.org>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Jean-Jacques Hiblot <jjhiblot@ti.com>
Cc: Pratyush Yadav <p.yadav@ti.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
---

diff --git a/test/dm/regmap.c b/test/dm/regmap.c
index 04bb1645d1..8560f2afc2 100644
--- a/test/dm/regmap.c
+++ b/test/dm/regmap.c
@@ -286,8 +286,7 @@ U_BOOT_DRIVER(regmap_test) = {
 static int dm_test_devm_regmap(struct unit_test_state *uts)
 {
 	int i = 0;
-	u16 val;
-	void *valp = &val;
+	uint val;
 	u16 pattern[REGMAP_TEST_BUF_SZ];
 	u16 *buffer;
 	struct udevice *dev;
@@ -311,7 +310,7 @@ static int dm_test_devm_regmap(struct unit_test_state *uts)
 		ut_assertok(regmap_write(priv->cfg_regmap, i, pattern[i]));
 	}
 	for (i = 0; i < REGMAP_TEST_BUF_SZ; i++) {
-		ut_assertok(regmap_read(priv->cfg_regmap, i, valp));
+		ut_assertok(regmap_read(priv->cfg_regmap, i, &val));
 		ut_asserteq(val, buffer[i]);
 		ut_asserteq(val, pattern[i]);
 	}
@@ -319,9 +318,9 @@ static int dm_test_devm_regmap(struct unit_test_state *uts)
 	ut_asserteq(-ERANGE, regmap_write(priv->cfg_regmap, REGMAP_TEST_BUF_SZ,
 					  val));
 	ut_asserteq(-ERANGE, regmap_read(priv->cfg_regmap, REGMAP_TEST_BUF_SZ,
-					 valp));
+					 &val));
 	ut_asserteq(-ERANGE, regmap_write(priv->cfg_regmap, -1, val));
-	ut_asserteq(-ERANGE, regmap_read(priv->cfg_regmap, -1, valp));
+	ut_asserteq(-ERANGE, regmap_read(priv->cfg_regmap, -1, &val));
 
 	return 0;
 }