Skip to contentSkip to conversation

iio: dac: ad5592r: Off by one bug in ad5592r_alloc_channels()

PATCH Applied Dan Carpenter 2 participants 3 messages Apr 29, 2016 – May 4, 2016

Subsystems (3)
Kernel janitors IIO Analog Devices IIO drivers
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 iio: dac: ad5592r: Off by one bug in ad5592r_alloc_channels()

The > here should be >= or we go beyond the end for the array.

Signed-off-by Dan Carpenter <[email protected]>
drivers/iio/dac/ad5592r-base.c +1 -1
index 948f600..69bde59 100644
@@ -525,7 +525,7 @@ static int ad5592r_alloc_channels(struct ad5592r_state *st)
 
 	device_for_each_child_node(st->dev, child) {
 		ret = fwnode_property_read_u32(child, "reg", &reg);
-		if (ret || reg > ARRAY_SIZE(st->channel_modes))
+		if (ret || reg >= ARRAY_SIZE(st->channel_modes))
 			continue;
 
 		ret = fwnode_property_read_u32(child, "adi,mode", &tmp);
maintainer
#1 lore raw
Quoted 3 lines · Dan Carpenter

The > here should be >= or we go beyond the end for the array.

Signed-off-by Dan Carpenter <[email protected]>

Good spot - marked it to pick up when I am back on the internet soonish.... (though perhaps not when I my computer manages to sneak this lot out!)

Quoted 19 lines
drivers/iio/dac/ad5592r-base.c +1 -2
index 948f600..69bde59 100644
@@ -525,7 +525,7 @@ static int ad5592r_alloc_channels(struct ad5592r_state *st)
 
 	device_for_each_child_node(st->dev, child) {
 		ret = fwnode_property_read_u32(child, "reg", &reg);
-		if (ret || reg > ARRAY_SIZE(st->channel_modes))
+		if (ret || reg >= ARRAY_SIZE(st->channel_modes))
 			continue;
 
 		ret = fwnode_property_read_u32(child, "adi,mode", &tmp);
--

To unsubscribe from this list: send the line "unsubscribe linux-iio" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

maintainer Applied
#2 lore raw
Quoted 6 lines · Jonathan Cameron
Quoted 3 lines · Dan Carpenter

The > here should be >= or we go beyond the end for the array.

Signed-off-by Dan Carpenter <[email protected]>

Good spot - marked it to pick up when I am back on the internet soonish.... (though perhaps not when I my computer manages to sneak this lot out!)

Applied to the fixes-togreg-post-rc1 branch of iio.git which I'll push out sometime in the next few days.

Jonathan

Quoted 25 lines
Quoted 15 lines
drivers/iio/dac/ad5592r-base.c +1 -2
index 948f600..69bde59 100644
@@ -525,7 +525,7 @@ static int ad5592r_alloc_channels(struct ad5592r_state *st)
 
 	device_for_each_child_node(st->dev, child) {
 		ret = fwnode_property_read_u32(child, "reg", &reg);
-		if (ret || reg > ARRAY_SIZE(st->channel_modes))
+		if (ret || reg >= ARRAY_SIZE(st->channel_modes))
 			continue;
 
 		ret = fwnode_property_read_u32(child, "adi,mode", &tmp);
--
Quoted 4 lines

To unsubscribe from this list: send the line "unsubscribe linux-iio" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe linux-iio" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html