Messages in this thread | | | Subject | Re: [PATCH] iio: ad5755: fix off-by-one on devnr limit check | From | Jonathan Cameron <> | Date | Sun, 21 Aug 2016 20:30:35 +0100 |
| |
On 25/07/16 23:40, Colin King wrote: > From: Colin Ian King <colin.king@canonical.com> > > The comparison for devnr limits is off-by-one, the current check > allows 0 to AD5755_NUM_CHANNELS and the limit should be in fact > 0 to AD5755_NUM_CHANNELS - 1. This can lead to an out of bounds > write to pdata->dac[devnr]. Fix this by replacing > with >= on the > comparison. > > Signed-off-by: Colin Ian King <colin.king@canonical.com> Lars?
Looks correct to me.
I'd also like a fixes tag for this if possible. Guessing it might well be the original driver introduction but best to be sure ;)
Jonathan > --- > drivers/iio/dac/ad5755.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/iio/dac/ad5755.c b/drivers/iio/dac/ad5755.c > index 0fde593..5f79682 100644 > --- a/drivers/iio/dac/ad5755.c > +++ b/drivers/iio/dac/ad5755.c > @@ -655,7 +655,7 @@ static struct ad5755_platform_data *ad5755_parse_dt(struct device *dev) > > devnr = 0; > for_each_child_of_node(np, pp) { > - if (devnr > AD5755_NUM_CHANNELS) { > + if (devnr >= AD5755_NUM_CHANNELS) { > dev_err(dev, > "There is to many channels defined in DT\n"); > goto error_out; >
| |