tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

iio: adc: palmas: fix off by one bugs

Valid values for "adc_chan" are zero to (PALMAS_ADC_CH_MAX - 1).
Smatch detects some buffer overflows caused by this:
drivers/iio/adc/palmas_gpadc.c:721 palmas_gpadc_read_event_value() error: buffer overflow 'adc->thresholds' 16 <= 16
drivers/iio/adc/palmas_gpadc.c:758 palmas_gpadc_write_event_value() error: buffer overflow 'adc->thresholds' 16 <= 16

The effect of this bug in other functions is more complicated but
obviously we should fix all of them.

Fixes: a99544c6c883 ("iio: adc: palmas: add support for iio threshold events")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/14fee94a-7db7-4371-b7d6-e94d86b9561e@kili.mountain
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

authored by

Dan Carpenter and committed by
Jonathan Cameron 279c3a2a 27b2ed5b

+5 -5
+5 -5
drivers/iio/adc/palmas_gpadc.c
··· 547 547 int adc_chan = chan->channel; 548 548 int ret = 0; 549 549 550 - if (adc_chan > PALMAS_ADC_CH_MAX) 550 + if (adc_chan >= PALMAS_ADC_CH_MAX) 551 551 return -EINVAL; 552 552 553 553 mutex_lock(&adc->lock); ··· 595 595 int adc_chan = chan->channel; 596 596 int ret = 0; 597 597 598 - if (adc_chan > PALMAS_ADC_CH_MAX || type != IIO_EV_TYPE_THRESH) 598 + if (adc_chan >= PALMAS_ADC_CH_MAX || type != IIO_EV_TYPE_THRESH) 599 599 return -EINVAL; 600 600 601 601 mutex_lock(&adc->lock); ··· 684 684 int adc_chan = chan->channel; 685 685 int ret; 686 686 687 - if (adc_chan > PALMAS_ADC_CH_MAX || type != IIO_EV_TYPE_THRESH) 687 + if (adc_chan >= PALMAS_ADC_CH_MAX || type != IIO_EV_TYPE_THRESH) 688 688 return -EINVAL; 689 689 690 690 mutex_lock(&adc->lock); ··· 710 710 int adc_chan = chan->channel; 711 711 int ret; 712 712 713 - if (adc_chan > PALMAS_ADC_CH_MAX || type != IIO_EV_TYPE_THRESH) 713 + if (adc_chan >= PALMAS_ADC_CH_MAX || type != IIO_EV_TYPE_THRESH) 714 714 return -EINVAL; 715 715 716 716 mutex_lock(&adc->lock); ··· 744 744 int old; 745 745 int ret; 746 746 747 - if (adc_chan > PALMAS_ADC_CH_MAX || type != IIO_EV_TYPE_THRESH) 747 + if (adc_chan >= PALMAS_ADC_CH_MAX || type != IIO_EV_TYPE_THRESH) 748 748 return -EINVAL; 749 749 750 750 mutex_lock(&adc->lock);