| Message ID | 20240814191946.81386-1-marex@denx.de (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | iio: light: noa1305: Fix up integration time look up | expand |
On Wed, 14 Aug 2024 21:19:09 +0200 Marek Vasut <marex@denx.de> wrote: > The current code is always iterating over two fields in the > noa1305_int_time_available array. Fix iteration limit, which > has to be halved to avoid out of bounds access in case the > value that is being looked up is not in the array. > > Fixes: 025f23cfebad ("iio: light: noa1305: Make integration time configurable") > Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > Suggested-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> > Signed-off-by: Marek Vasut <marex@denx.de> Applied. Thanks, > --- > Cc: "Uwe Kleine-König" <u.kleine-koenig@pengutronix.de> > Cc: Jonathan Cameron <jic23@kernel.org> > Cc: Lars-Peter Clausen <lars@metafoo.de> > Cc: linux-iio@vger.kernel.org > --- > drivers/iio/light/noa1305.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/iio/light/noa1305.c b/drivers/iio/light/noa1305.c > index da83425fd9100..25f63da70297e 100644 > --- a/drivers/iio/light/noa1305.c > +++ b/drivers/iio/light/noa1305.c > @@ -197,7 +197,7 @@ static int noa1305_write_raw(struct iio_dev *indio_dev, > return -EINVAL; > > /* Look up integration time register settings and write it if found. */ > - for (i = 0; i < ARRAY_SIZE(noa1305_int_time_available); i++) > + for (i = 0; i < ARRAY_SIZE(noa1305_int_time_available) / 2; i++) > if (noa1305_int_time_available[2 * i + 1] == val2) > return regmap_write(priv->regmap, NOA1305_REG_INTEGRATION_TIME, i); >
diff --git a/drivers/iio/light/noa1305.c b/drivers/iio/light/noa1305.c index da83425fd9100..25f63da70297e 100644 --- a/drivers/iio/light/noa1305.c +++ b/drivers/iio/light/noa1305.c @@ -197,7 +197,7 @@ static int noa1305_write_raw(struct iio_dev *indio_dev, return -EINVAL; /* Look up integration time register settings and write it if found. */ - for (i = 0; i < ARRAY_SIZE(noa1305_int_time_available); i++) + for (i = 0; i < ARRAY_SIZE(noa1305_int_time_available) / 2; i++) if (noa1305_int_time_available[2 * i + 1] == val2) return regmap_write(priv->regmap, NOA1305_REG_INTEGRATION_TIME, i);
The current code is always iterating over two fields in the noa1305_int_time_available array. Fix iteration limit, which has to be halved to avoid out of bounds access in case the value that is being looked up is not in the array. Fixes: 025f23cfebad ("iio: light: noa1305: Make integration time configurable") Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Suggested-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Marek Vasut <marex@denx.de> --- Cc: "Uwe Kleine-König" <u.kleine-koenig@pengutronix.de> Cc: Jonathan Cameron <jic23@kernel.org> Cc: Lars-Peter Clausen <lars@metafoo.de> Cc: linux-iio@vger.kernel.org --- drivers/iio/light/noa1305.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)