[PATCH 1/5] mfd: tps65219: Fix out-of-bounds access in tps65214 IRQ map

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>

The tps65214_sub_irq_offsets[] array has only seven entries (bits 0-5
and 7; INT_SOURCE bit 6 is reserved) while the corresponding IRQ chip
advertises num_main_status_bits = 8.  regmap-irq's read_irq_data()
indexes sub_reg_offsets with the main-status bit number, so whenever
bit 7 of INT_SOURCE is set (the power-button interrupt) it reads past
the end of the seven-element array and uses garbage offset/num_regs
values to compute status_buf indices, which can also lead to an
out-of-bounds status_buf access.

Add an empty placeholder entry for the reserved bit 6 so that the array
lines up with the bit numbering and bit 7 hits the power-button entry.

Fixes: 7947219ab1a2 ("mfd: tps65219: Add support for TI TPS65214 PMIC")
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
---
diff --git a/drivers/mfd/tps65219.c b/drivers/mfd/tps65219.c
index f8c08dd86618..4f4bfc49542c 100644
--- a/drivers/mfd/tps65219.c
+++ b/drivers/mfd/tps65219.c
@@ -268,6 +268,7 @@ static const struct regmap_irq_sub_irq_map tps65214_sub_irq_offsets[] = {
 	REGMAP_IRQ_MAIN_REG_OFFSET(tps65214_bit3_offsets),
 	REGMAP_IRQ_MAIN_REG_OFFSET(tps65214_bit4_offsets),
 	REGMAP_IRQ_MAIN_REG_OFFSET(tps65214_bit5_offsets),
+	{ .num_regs = 0 },	/* INT_SOURCE bit 6 is reserved */
 	REGMAP_IRQ_MAIN_REG_OFFSET(tps65214_bit7_offsets),
 };