| Message ID | 69c5cb83-0209-40ff-a276-a0ae5e81c528@moroto.mountain (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | iio: light: apds9306: Fix off by one in apds9306_sampling_freq_get() | expand |
On 4/4/24 18:01, Dan Carpenter wrote: > The > comparison needs to be >= to prevent an out of bounds access. > > Fixes: 620d1e6c7a3f ("iio: light: Add support for APDS9306 Light Sensor") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- > drivers/iio/light/apds9306.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/iio/light/apds9306.c b/drivers/iio/light/apds9306.c > index 4d8490602cd7..49fa6b7d5170 100644 > --- a/drivers/iio/light/apds9306.c > +++ b/drivers/iio/light/apds9306.c > @@ -635,7 +635,7 @@ static int apds9306_sampling_freq_get(struct apds9306_data *data, int *val, > if (ret) > return ret; > > - if (repeat_rate_idx > ARRAY_SIZE(apds9306_repeat_rate_freq)) > + if (repeat_rate_idx >= ARRAY_SIZE(apds9306_repeat_rate_freq)) > return -EINVAL; Good find. Reviewed-by: Subhajit Ghosh <subhajit.ghosh@tweaklogic.com> Regards, Subhajit Ghosh > > *val = apds9306_repeat_rate_freq[repeat_rate_idx][0];
On Fri, 5 Apr 2024 17:44:31 +1030 Subhajit Ghosh <subhajit.ghosh@tweaklogic.com> wrote: > On 4/4/24 18:01, Dan Carpenter wrote: > > The > comparison needs to be >= to prevent an out of bounds access. > > > > Fixes: 620d1e6c7a3f ("iio: light: Add support for APDS9306 Light Sensor") > > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > > --- > > drivers/iio/light/apds9306.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/iio/light/apds9306.c b/drivers/iio/light/apds9306.c > > index 4d8490602cd7..49fa6b7d5170 100644 > > --- a/drivers/iio/light/apds9306.c > > +++ b/drivers/iio/light/apds9306.c > > @@ -635,7 +635,7 @@ static int apds9306_sampling_freq_get(struct apds9306_data *data, int *val, > > if (ret) > > return ret; > > > > - if (repeat_rate_idx > ARRAY_SIZE(apds9306_repeat_rate_freq)) > > + if (repeat_rate_idx >= ARRAY_SIZE(apds9306_repeat_rate_freq)) > > return -EINVAL; > Good find. > > Reviewed-by: Subhajit Ghosh <subhajit.ghosh@tweaklogic.com> > Applied to the togreg branch of iio.git (where the fixes patch is currently) and pushed out as testing initially because there is other stuff in there I want 0-day to checkout before I make a mess of linux-next. Thanks, Jonathan > Regards, > Subhajit Ghosh > > > > *val = apds9306_repeat_rate_freq[repeat_rate_idx][0]; >
diff --git a/drivers/iio/light/apds9306.c b/drivers/iio/light/apds9306.c index 4d8490602cd7..49fa6b7d5170 100644 --- a/drivers/iio/light/apds9306.c +++ b/drivers/iio/light/apds9306.c @@ -635,7 +635,7 @@ static int apds9306_sampling_freq_get(struct apds9306_data *data, int *val, if (ret) return ret; - if (repeat_rate_idx > ARRAY_SIZE(apds9306_repeat_rate_freq)) + if (repeat_rate_idx >= ARRAY_SIZE(apds9306_repeat_rate_freq)) return -EINVAL; *val = apds9306_repeat_rate_freq[repeat_rate_idx][0];
The > comparison needs to be >= to prevent an out of bounds access. Fixes: 620d1e6c7a3f ("iio: light: Add support for APDS9306 Light Sensor") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- drivers/iio/light/apds9306.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)