Skip to contentSkip to conversation

hwmon: (ads1015) Fix out-of-bounds array access

PATCH Superseded Axel Lin 2 participants 2 messages Aug 2, 2014 – Aug 4, 2014 Hardware monitoring

v2 of 3 Superseded Latest is v3 →

lore
Share & tools
lore

Axel Lin

author
#0 lore raw

PATCH v2 1/2 hwmon: (ads1015) Fix out-of-bounds array access

Current code uses data_rate as array index in ads1015_read_adc() and uses pga as array index in ads1015_reg_to_mv, so we must make sure both data_rate and pga settings are in valid value range. Both "ti,gain" and "ti,datarate" are optional properties, so use default setting if the setting is out-of-range.

Signed-off-by Axel Lin <[email protected]>
---
 drivers/hwmon/ads1015.c | 2 ++
 1 file changed, 2 insertions(+)
drivers/hwmon/ads1015.c +2 -0
index 22e0c92..fe1a5a1 100644
@@ -212,6 +212,7 @@ static int ads1015_get_channels_config_of(struct i2c_client *client)
 				dev_err(&client->dev,
 					"invalid gain on %s\n",
 					node->full_name);
+				pga = ADS1015_DEFAULT_PGA;
 			}
 		}
 

@@ -222,6 +223,7 @@ static int ads1015_get_channels_config_of(struct i2c_client *client)
 				dev_err(&client->dev,
 					"invalid data_rate on %s\n",
 					node->full_name);
+				data_rate = ADS1015_DEFAULT_DATA_RATE;
 			}
 		}
Signature · 9 lines
1.9.1




_______________________________________________
lm-sensors mailing list
[email protected]
http://lists.lm-sensors.org/mailman/listinfo/lm-sensors
maintainer
#1 lore raw
Quoted 6 lines · Axel Lin

Current code uses data_rate as array index in ads1015_read_adc() and uses pga as array index in ads1015_reg_to_mv, so we must make sure both data_rate and pga settings are in valid value range. Both "ti,gain" and "ti,datarate" are optional properties, so use default setting if the setting is out-of-range.

Signed-off-by Axel Lin <[email protected]>

Excellent catch.

I don't like either solution, though. Returning -EINVAL in the error case seems to be more appropriate and should be the expected response.

Guenter

Quoted 18 lines
---
  drivers/hwmon/ads1015.c | 2 ++
  1 file changed, 2 insertions(+)
drivers/hwmon/ads1015.c +1 -0
index 22e0c92..fe1a5a1 100644
@@ -212,6 +212,7 @@ static int ads1015_get_channels_config_of(struct i2c_client *client)
  				dev_err(&client->dev,
  					"invalid gain on %s\n",
  					node->full_name);
+				pga = ADS1015_DEFAULT_PGA;
  			}
  		}

drivers/hwmon/ads1015.c static int ads1015_get_channels_config_of(struct i2c_client *client) · line 229

Quoted 7 lines
drivers/hwmon/ads1015.c +1 -0
@@ -222,6 +223,7 @@ static int ads1015_get_channels_config_of(struct i2c_client *client)
  				dev_err(&client->dev,
  					"invalid data_rate on %s\n",
  					node->full_name);
+				data_rate = ADS1015_DEFAULT_DATA_RATE;
  			}
  		}

_______________________________________________
lm-sensors mailing list
[email protected]
http://lists.lm-sensors.org/mailman/listinfo/lm-sensors