| Message ID | 20241022134330.574601-1-quzicheng@huawei.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | drivers/iio/adc/ad7124.c: fix division by zero in ad7124_set_channel_odr() | expand |
On Tue, 2024-10-22 at 13:43 +0000, Zicheng Qu wrote: > In the ad7124_write_raw() function, parameter val can potentially > be zero. This may lead to a division by zero when DIV_ROUND_CLOSEST() > is called within ad7124_set_channel_odr(). The ad7124_write_raw() > function is invoked through the sequence: iio_write_channel_raw() -> > iio_write_channel_attribute() -> iio_channel_write(), with no checks > in place to ensure val is non-zero. > > Cc: stable@vger.kernel.org > Fixes: 7b8d045e497a ("iio: adc: ad7124: allow more than 8 channels") > Signed-off-by: Zicheng Qu <quzicheng@huawei.com> > --- LGTM, Reviewed-by: Nuno Sa <nuno.sa@analog.com> > drivers/iio/adc/ad7124.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c > index a5d91933f505..b79c48d46ccc 100644 > --- a/drivers/iio/adc/ad7124.c > +++ b/drivers/iio/adc/ad7124.c > @@ -637,7 +637,7 @@ static int ad7124_write_raw(struct iio_dev *indio_dev, > > switch (info) { > case IIO_CHAN_INFO_SAMP_FREQ: > - if (val2 != 0) { > + if (val2 != 0 || val == 0) { > ret = -EINVAL; > break; > }
On Tue, 22 Oct 2024 16:23:17 +0200 Nuno Sá <noname.nuno@gmail.com> wrote: > On Tue, 2024-10-22 at 13:43 +0000, Zicheng Qu wrote: > > In the ad7124_write_raw() function, parameter val can potentially > > be zero. This may lead to a division by zero when DIV_ROUND_CLOSEST() > > is called within ad7124_set_channel_odr(). The ad7124_write_raw() > > function is invoked through the sequence: iio_write_channel_raw() -> > > iio_write_channel_attribute() -> iio_channel_write(), with no checks > > in place to ensure val is non-zero. > > > > Cc: stable@vger.kernel.org > > Fixes: 7b8d045e497a ("iio: adc: ad7124: allow more than 8 channels") > > Signed-off-by: Zicheng Qu <quzicheng@huawei.com> > > --- > > LGTM, > > Reviewed-by: Nuno Sa <nuno.sa@analog.com> As with the other patch, I fixed up the patch title to match local style. Applied to the fixes-togreg branch of iio.git Thanks, Jonathan > > > drivers/iio/adc/ad7124.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c > > index a5d91933f505..b79c48d46ccc 100644 > > --- a/drivers/iio/adc/ad7124.c > > +++ b/drivers/iio/adc/ad7124.c > > @@ -637,7 +637,7 @@ static int ad7124_write_raw(struct iio_dev *indio_dev, > > > > switch (info) { > > case IIO_CHAN_INFO_SAMP_FREQ: > > - if (val2 != 0) { > > + if (val2 != 0 || val == 0) { > > ret = -EINVAL; > > break; > > } >
diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c index a5d91933f505..b79c48d46ccc 100644 --- a/drivers/iio/adc/ad7124.c +++ b/drivers/iio/adc/ad7124.c @@ -637,7 +637,7 @@ static int ad7124_write_raw(struct iio_dev *indio_dev, switch (info) { case IIO_CHAN_INFO_SAMP_FREQ: - if (val2 != 0) { + if (val2 != 0 || val == 0) { ret = -EINVAL; break; }
In the ad7124_write_raw() function, parameter val can potentially be zero. This may lead to a division by zero when DIV_ROUND_CLOSEST() is called within ad7124_set_channel_odr(). The ad7124_write_raw() function is invoked through the sequence: iio_write_channel_raw() -> iio_write_channel_attribute() -> iio_channel_write(), with no checks in place to ensure val is non-zero. Cc: stable@vger.kernel.org Fixes: 7b8d045e497a ("iio: adc: ad7124: allow more than 8 channels") Signed-off-by: Zicheng Qu <quzicheng@huawei.com> --- drivers/iio/adc/ad7124.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)