| Message ID | 1502378614-13011-1-git-send-email-vasilyev@ispras.ru (mailing list archive) |
|---|---|
| State | Changes Requested |
| Headers | show |
On Thu, Aug 10, 2017 at 06:23:34PM +0300, Anton Vasilyev wrote: > If stts751 hw by some reason reports conversion rate bigger then 9: > ret = i2c_smbus_read_byte_data(priv->client, STTS751_REG_RATE); > then dereference stts751_intervals[priv->interval] leads to buffer > overread. > > The path adds sanity check for value read from chip. > > Found by Linux Driver Verification project (linuxtesting.org). > > Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru> > --- > drivers/hwmon/stts751.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/hwmon/stts751.c b/drivers/hwmon/stts751.c > index d56251d..f6eddbd 100644 > --- a/drivers/hwmon/stts751.c > +++ b/drivers/hwmon/stts751.c > @@ -718,6 +718,10 @@ static int stts751_read_chip_config(struct stts751_priv *priv) > ret = i2c_smbus_read_byte_data(priv->client, STTS751_REG_RATE); > if (ret < 0) > return ret; > + if (ret > ARRAY_SIZE(stts751_intervals)) { Great catch, but should this be >= ? Guenter > + dev_err(priv->dev, "Unrecognized conversion rate 0x%x\n", ret); > + return -ENODEV; > + } > priv->interval = ret; > > ret = stts751_read_reg16(priv, &priv->event_max, > -- > 2.7.4 > -- To unsubscribe from this list: send the line "unsubscribe linux-hwmon" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/hwmon/stts751.c b/drivers/hwmon/stts751.c index d56251d..f6eddbd 100644 --- a/drivers/hwmon/stts751.c +++ b/drivers/hwmon/stts751.c @@ -718,6 +718,10 @@ static int stts751_read_chip_config(struct stts751_priv *priv) ret = i2c_smbus_read_byte_data(priv->client, STTS751_REG_RATE); if (ret < 0) return ret; + if (ret > ARRAY_SIZE(stts751_intervals)) { + dev_err(priv->dev, "Unrecognized conversion rate 0x%x\n", ret); + return -ENODEV; + } priv->interval = ret; ret = stts751_read_reg16(priv, &priv->event_max,
If stts751 hw by some reason reports conversion rate bigger then 9: ret = i2c_smbus_read_byte_data(priv->client, STTS751_REG_RATE); then dereference stts751_intervals[priv->interval] leads to buffer overread. The path adds sanity check for value read from chip. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru> --- drivers/hwmon/stts751.c | 4 ++++ 1 file changed, 4 insertions(+)