mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 21:33:52 +00:00
iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
commit792595bab4
upstream. Recently, we encounter kernel crash in function rm3100_common_probe caused by out of bound access of array rm3100_samp_rates (because of underlying hardware failures). Add boundary check to prevent out of bound access. Fixes:121354b2ec
("iio: magnetometer: Add driver support for PNI RM3100") Suggested-by: Zhouyi Zhou <zhouzhouyi@gmail.com> Signed-off-by: zhili.liu <zhili.liu@ucas.com.cn> Link: https://lore.kernel.org/r/1704157631-3814-1-git-send-email-zhouzhouyi@gmail.com Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
fa5884dd5b
commit
36a49290d7
1 changed files with 8 additions and 2 deletions
|
@ -538,6 +538,7 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq)
|
|||
struct rm3100_data *data;
|
||||
unsigned int tmp;
|
||||
int ret;
|
||||
int samp_rate_index;
|
||||
|
||||
indio_dev = devm_iio_device_alloc(dev, sizeof(*data));
|
||||
if (!indio_dev)
|
||||
|
@ -596,9 +597,14 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq)
|
|||
ret = regmap_read(regmap, RM3100_REG_TMRC, &tmp);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
|
||||
samp_rate_index = tmp - RM3100_TMRC_OFFSET;
|
||||
if (samp_rate_index < 0 || samp_rate_index >= RM3100_SAMP_NUM) {
|
||||
dev_err(dev, "The value read from RM3100_REG_TMRC is invalid!\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
/* Initializing max wait time, which is double conversion time. */
|
||||
data->conversion_time = rm3100_samp_rates[tmp - RM3100_TMRC_OFFSET][2]
|
||||
* 2;
|
||||
data->conversion_time = rm3100_samp_rates[samp_rate_index][2] * 2;
|
||||
|
||||
/* Cycle count values may not be what we want. */
|
||||
if ((tmp - RM3100_TMRC_OFFSET) == 0)
|
||||
|
|
Loading…
Reference in a new issue