korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-17 09:14:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

iio: ssp_sensors: add more range checking in ssp_parse_dataframe()

Browse Source 
The "idx" is validated at the start of the loop but it gets incremented
during the iteration so it needs to be checked again.

Fixes: 50dd64d57e ("iio: common: ssp_sensors: Add sensorhub driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20210909091336.GA26312@kili
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
This commit is contained in:
Dan Carpenter 2021-09-09 12:13:36 +03:00 committed by Jonathan Cameron
parent 4170d3dd14
commit 8167c9a375
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/iio/common/ssp_sensors/ssp_spi.c
View File

@ -273,6 +273,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len)
for (idx = 0; idx < len;) { for (idx = 0; idx < len;) {
switch (dataframe[idx++]) { switch (dataframe[idx++]) {
case SSP_MSG2AP_INST_BYPASS_DATA: case SSP_MSG2AP_INST_BYPASS_DATA:
if (idx >= len)
return -EPROTO;
sd = dataframe[idx++]; sd = dataframe[idx++];
if (sd < 0 || sd >= SSP_SENSOR_MAX) { if (sd < 0 || sd >= SSP_SENSOR_MAX) {
dev_err(SSP_DEV, dev_err(SSP_DEV,
@ -282,10 +284,13 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len)
if (indio_devs[sd]) { if (indio_devs[sd]) {
spd = iio_priv(indio_devs[sd]); spd = iio_priv(indio_devs[sd]);
if (spd->process_data) if (spd->process_data) {
if (idx >= len)
return -EPROTO;
spd->process_data(indio_devs[sd], spd->process_data(indio_devs[sd],
&dataframe[idx], &dataframe[idx],
data->timestamp); data->timestamp);
}
} else { } else {
dev_err(SSP_DEV, "no client for frame\n"); dev_err(SSP_DEV, "no client for frame\n");
} }
@ -293,6 +298,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len)
idx += ssp_offset_map[sd]; idx += ssp_offset_map[sd];
break; break;
case SSP_MSG2AP_INST_DEBUG_DATA: case SSP_MSG2AP_INST_DEBUG_DATA:
if (idx >= len)
return -EPROTO;
sd = ssp_print_mcu_debug(dataframe, &idx, len); sd = ssp_print_mcu_debug(dataframe, &idx, len);
if (sd) { if (sd) {
dev_err(SSP_DEV, dev_err(SSP_DEV,