lkml.org 
[lkml]   [2021]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 065/279] iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr()
    Date
    From: Teng Qi <starmiku1207184332@gmail.com>

    [ Upstream commit 94be878c882d8d784ff44c639bf55f3b029f85af ]

    The length of hw->settings->odr_table is 2 and ref_sensor->id is an enum
    variable whose value is between 0 and 5.
    However, the value ST_LSM6DSX_ID_MAX (i.e. 5) is not caught properly in
    switch (sensor->id) {

    If ref_sensor->id is ST_LSM6DSX_ID_MAX, an array overflow will ocurrs in
    function st_lsm6dsx_check_odr():
    odr_table = &sensor->hw->settings->odr_table[sensor->id];

    and in function st_lsm6dsx_set_odr():
    reg = &hw->settings->odr_table[ref_sensor->id].reg;

    To avoid this array overflow, handle ST_LSM6DSX_ID_GYRO explicitly and
    return -EINVAL for the default case.

    The enum value ST_LSM6DSX_ID_MAX is only present as an easy way to check
    the limit and as such is never used, however this is not locally obvious.

    Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
    Signed-off-by: Teng Qi <starmiku1207184332@gmail.com>
    Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
    Link: https://lore.kernel.org/r/20211011114003.976221-1-starmiku1207184332@gmail.com
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
    index db45f1fc0b817..8dbf744c5651f 100644
    --- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
    +++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
    @@ -1279,6 +1279,8 @@ st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u32 req_odr)
    int err;

    switch (sensor->id) {
    + case ST_LSM6DSX_ID_GYRO:
    + break;
    case ST_LSM6DSX_ID_EXT0:
    case ST_LSM6DSX_ID_EXT1:
    case ST_LSM6DSX_ID_EXT2:
    @@ -1304,8 +1306,8 @@ st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u32 req_odr)
    }
    break;
    }
    - default:
    - break;
    + default: /* should never occur */
    + return -EINVAL;
    }

    if (req_odr > 0) {
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-24 14:49    [W:5.025 / U:1.260 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site