test: Fix pointer overrun in dm_test_devm_regmap()

This tests calls regmap_read() which takes a uint pointer as an output
parameter. The test was passing a pointer to a u16 which resulted in an
overflow when the output was written. Fix this by following the
regmap_read() API and passing a uint pointer instead.

Signed-off-by: Andrew Scull <ascull@google.com>
Cc: Simon Glass <sjg@chromium.org>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Jean-Jacques Hiblot <jjhiblot@ti.com>
Cc: Pratyush Yadav <p.yadav@ti.com>
Reviewed-by: Simon Glass <sjg@chromium.org>

diff --git a/test/dm/regmap.c b/test/dm/regmap.c
index 04bb164..8560f2a 100644 (file)
--- a/test/dm/regmap.c
+++ b/test/dm/regmap.c
@@ -286,8 +286,7 @@ U_BOOT_DRIVER(regmap_test) = {
 static int dm_test_devm_regmap(struct unit_test_state *uts)
 {
        int i = 0;
-       u16 val;
-       void *valp = &val;
+       uint val;
        u16 pattern[REGMAP_TEST_BUF_SZ];
        u16 *buffer;
        struct udevice *dev;
@@ -311,7 +310,7 @@ static int dm_test_devm_regmap(struct unit_test_state *uts)
                ut_assertok(regmap_write(priv->cfg_regmap, i, pattern[i]));
        }
        for (i = 0; i < REGMAP_TEST_BUF_SZ; i++) {
-               ut_assertok(regmap_read(priv->cfg_regmap, i, valp));
+               ut_assertok(regmap_read(priv->cfg_regmap, i, &val));
                ut_asserteq(val, buffer[i]);
                ut_asserteq(val, pattern[i]);
        }
@@ -319,9 +318,9 @@ static int dm_test_devm_regmap(struct unit_test_state *uts)
        ut_asserteq(-ERANGE, regmap_write(priv->cfg_regmap, REGMAP_TEST_BUF_SZ,
                                          val));
        ut_asserteq(-ERANGE, regmap_read(priv->cfg_regmap, REGMAP_TEST_BUF_SZ,
-                                        valp));
+                                        &val));
        ut_asserteq(-ERANGE, regmap_write(priv->cfg_regmap, -1, val));
-       ut_asserteq(-ERANGE, regmap_read(priv->cfg_regmap, -1, valp));
+       ut_asserteq(-ERANGE, regmap_read(priv->cfg_regmap, -1, &val));
 
        return 0;
 }