iio: stx104: Store channel output state values as int
PATCH 1/1 iio: stx104: Store channel output state values as int
The val parameter has a data type of int in the read_raw and write_raw callbacks. The chan_out_states array should have elements of type int in order to match the data type of the val parameter.
This patch fixes a possible integer overflow condition when the the int pointer val is dereferenced to store the unsigned int chan_out_states element in the read_raw callback.
--- drivers/iio/dac/stx104.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dac/stx104.c +1 -1
@@ -47,7 +47,7 @@ MODULE_PARM_DESC(base, "Apex Embedded Systems STX104 base addresses");* @base: base port address of the IIO device */ struct stx104_iio { -unsigned chan_out_states[STX104_NUM_CHAN ]; +int chan_out_states[STX104_NUM_CHAN ];unsigned base; };
Signature · 1 line
2.7.3
Jonathan Cameron
maintainerQuoted 10 lines · William Breathitt Gray
The val parameter has a data type of int in the
read_rawandwrite_rawcallbacks. Thechan_out_statesarray should have elements of type int in order to match the data type of the val parameter.This patch fixes a possible integer overflow condition when the the int pointer val is dereferenced to store the unsigned int
chan_out_stateselement in theread_rawcallback.Fixes 97a445dad37a ("iio: Add IIO support for the DAC on the Apex Embedded Systems STX104")Signed-off-by William Breathitt Gray <[email protected]>
Isn't this only a problem if an out of range value was written in the first place? The values it'll take are only 16bits, so a simple range check around that would fix the root problem.
J
Quoted 18 lines
--- drivers/iio/dac/stx104.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/iio/dac/stx104.c +1
-1@@ -47,7 +47,7 @@ MODULE_PARM_DESC(base, "Apex Embedded Systems STX104 base addresses");* @base: base port address of the IIO device */ struct stx104_iio { -unsigned chan_out_states[STX104_NUM_CHAN ]; +int chan_out_states[STX104_NUM_CHAN ];unsigned base; };
Quoted 9 lines · Jonathan Cameron
Quoted 8 lines · William Breathitt Gray
The val parameter has a data type of int in the
read_rawandwrite_rawcallbacks. Thechan_out_statesarray should have elements of type int in order to match the data type of the val parameter.This patch fixes a possible integer overflow condition when the the int pointer val is dereferenced to store the unsigned int
chan_out_stateselement in theread_rawcallback.
Quoted 7 lines
Quoted 2 lines
Fixes 97a445dad37a ("iio: Add IIO support for the DAC on the Apex Embedded Systems STX104")Signed-off-by William Breathitt Gray <[email protected]>Isn't this only a problem if an out of range value was written in the first place? The values it'll take are only 16bits, so a simple range check around that would fix the root problem.
J
Please disregard this patch.
When I submitted this patch I had assumed the possibility of platforms with 16-bit int; if all platforms supported by the Linux kernel have at minimum 32-bit int, then a simple range check should be sufficient.
William Breathitt Gray
Quoted 19 lines
Quoted 18 lines
--- drivers/iio/dac/stx104.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/iio/dac/stx104.c +1
-1@@ -47,7 +47,7 @@ MODULE_PARM_DESC(base, "Apex Embedded Systems STX104 base addresses");* @base: base port address of the IIO device */ struct stx104_iio { -unsigned chan_out_states[STX104_NUM_CHAN ]; +int chan_out_states[STX104_NUM_CHAN ];unsigned base; };