diff options
| author | Wei Yongjun <[email protected]> | 2022-09-22 11:58:48 +0000 |
|---|---|---|
| committer | Jonathan Cameron <[email protected]> | 2022-11-23 19:43:57 +0000 |
| commit | 3f4033a811bcd1a1f077ce5297488a5c4dd30eb1 (patch) | |
| tree | adb14af6a3c73c706f3a191585321c4f507e0fcd | |
| parent | 8cf5f0329128efdfe18f12a8697752d39821fbdf (diff) | |
iio: filter: admv8818: close potential out-of-bounds read in __admv8818_read_[h|l]pf_freq()
ADMV8818_SW_IN_WR0_MSK and ADMV8818_SW_OUT_WR0_MSK have 3 bits,
which means a length of 8, but freq_range_hpf and freq_range_lpf
array size is 4, may end up reading 4 elements beyond the end of
those arrays.
Check value first before access freq_range_hpf and freq_range_lpf
to harden against the hardware allowing out of range values.
Signed-off-by: Wei Yongjun <[email protected]>
Reviewed-by: Antoniu Miclaus <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jonathan Cameron <[email protected]>
| -rw-r--r-- | drivers/iio/filter/admv8818.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/iio/filter/admv8818.c b/drivers/iio/filter/admv8818.c index 68de45fe21b4..fe8d46cb7f1d 100644 --- a/drivers/iio/filter/admv8818.c +++ b/drivers/iio/filter/admv8818.c @@ -265,7 +265,7 @@ static int __admv8818_read_hpf_freq(struct admv8818_state *st, u64 *hpf_freq) return ret; hpf_band = FIELD_GET(ADMV8818_SW_IN_WR0_MSK, data); - if (!hpf_band) { + if (!hpf_band || hpf_band > 4) { *hpf_freq = 0; return ret; } @@ -303,7 +303,7 @@ static int __admv8818_read_lpf_freq(struct admv8818_state *st, u64 *lpf_freq) return ret; lpf_band = FIELD_GET(ADMV8818_SW_OUT_WR0_MSK, data); - if (!lpf_band) { + if (!lpf_band || lpf_band > 4) { *lpf_freq = 0; return ret; } |