From: walter harms <wharms@bfs.de>
To: Brian Masney <masneyb@onstation.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>,
Jonathan Cameron <jic23@kernel.org>,
Hartmut Knaack <knaack.h@gmx.de>,
Lars-Peter Clausen <lars@metafoo.de>,
Peter Meerwald-Stadler <pmeerw@pmeerw.net>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Eva Rachel Retuya <eraretuya@gmail.com>,
linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-janitors@vger.kernel.org
Subject: Re: [patch] iio: tsl2583: make array large enough
Date: Thu, 24 Nov 2016 16:54:17 +0000 [thread overview]
Message-ID: <58371B39.30503@bfs.de> (raw)
In-Reply-To: <20161124154833.GB2118@basecamp.onstation.org>
Am 24.11.2016 16:48, schrieb Brian Masney:
> On Thu, Nov 24, 2016 at 04:38:07PM +0300, Dan Carpenter wrote:
>> This array is supposed to have 10 elements. Smatch complains that with
>> the current code we can have n = max_ints and read beyond the end of
>> the array.
>>
>> Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>>
>> diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
>> index 0b87f6a..a78b602 100644
>> --- a/drivers/iio/light/tsl2583.c
>> +++ b/drivers/iio/light/tsl2583.c
>> @@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev,
>> struct iio_dev *indio_dev = dev_to_iio_dev(dev);
>> struct tsl2583_chip *chip = iio_priv(indio_dev);
>> const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3;
>> - int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3];
>> + int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1];
>> int ret = -EINVAL;
>> unsigned int n;
>>
>
sorry i did not notice that bevor ..
there is a
max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3
IMHO this should read either:
int value[max_ints+1];
or
max_ints=ARRAY_SIZE(value)-1;
(my personal favorite is dropping max_ints completely).
re,
wh
WARNING: multiple messages have this Message-ID (diff)
From: walter harms <wharms@bfs.de>
To: Brian Masney <masneyb@onstation.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>,
Jonathan Cameron <jic23@kernel.org>,
Hartmut Knaack <knaack.h@gmx.de>,
Lars-Peter Clausen <lars@metafoo.de>,
Peter Meerwald-Stadler <pmeerw@pmeerw.net>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Eva Rachel Retuya <eraretuya@gmail.com>,
linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-janitors@vger.kernel.org
Subject: Re: [patch] iio: tsl2583: make array large enough
Date: Thu, 24 Nov 2016 17:54:17 +0100 [thread overview]
Message-ID: <58371B39.30503@bfs.de> (raw)
In-Reply-To: <20161124154833.GB2118@basecamp.onstation.org>
Am 24.11.2016 16:48, schrieb Brian Masney:
> On Thu, Nov 24, 2016 at 04:38:07PM +0300, Dan Carpenter wrote:
>> This array is supposed to have 10 elements. Smatch complains that with
>> the current code we can have n == max_ints and read beyond the end of
>> the array.
>>
>> Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>>
>> diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
>> index 0b87f6a..a78b602 100644
>> --- a/drivers/iio/light/tsl2583.c
>> +++ b/drivers/iio/light/tsl2583.c
>> @@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev,
>> struct iio_dev *indio_dev = dev_to_iio_dev(dev);
>> struct tsl2583_chip *chip = iio_priv(indio_dev);
>> const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3;
>> - int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3];
>> + int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1];
>> int ret = -EINVAL;
>> unsigned int n;
>>
>
sorry i did not notice that bevor ..
there is a
max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3
IMHO this should read either:
int value[max_ints+1];
or
max_ints=ARRAY_SIZE(value)-1;
(my personal favorite is dropping max_ints completely).
re,
wh
next prev parent reply other threads:[~2016-11-24 16:54 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-18 11:51 [patch] iio: tsl2583: off by one in in_illuminance_lux_table_store() Dan Carpenter
2016-11-18 11:51 ` Dan Carpenter
2016-11-18 14:03 ` Brian Masney
2016-11-18 14:03 ` Brian Masney
2016-11-24 13:38 ` [patch] iio: tsl2583: make array large enough Dan Carpenter
2016-11-24 13:38 ` Dan Carpenter
2016-11-24 15:48 ` Brian Masney
2016-11-24 15:48 ` Brian Masney
2016-11-24 16:54 ` walter harms [this message]
2016-11-24 16:54 ` walter harms
2016-11-24 17:51 ` Brian Masney
2016-11-24 17:51 ` Brian Masney
2016-11-24 20:12 ` Jonathan Cameron
2016-11-24 20:12 ` Jonathan Cameron
2016-11-25 8:53 ` walter harms
2016-11-25 8:53 ` walter harms
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=58371B39.30503@bfs.de \
--to=wharms@bfs.de \
--cc=dan.carpenter@oracle.com \
--cc=eraretuya@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=jic23@kernel.org \
--cc=kernel-janitors@vger.kernel.org \
--cc=knaack.h@gmx.de \
--cc=lars@metafoo.de \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=masneyb@onstation.org \
--cc=pmeerw@pmeerw.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.