* [PATCH AUTOSEL 6.0 12/18] iio: filter: admv8818: close potential out-of-bounds read in __admv8818_read_[h|l]pf_freq()
[not found] <20221224013034.392810-1-sashal@kernel.org>
@ 2022-12-24 1:30 ` Sasha Levin
0 siblings, 0 replies; only message in thread
From: Sasha Levin @ 2022-12-24 1:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Wei Yongjun, Antoniu Miclaus, Jonathan Cameron, Sasha Levin, lars,
Michael.Hennerich, jic23, linux-iio
From: Wei Yongjun <weiyongjun1@huawei.com>
[ Upstream commit 3f4033a811bcd1a1f077ce5297488a5c4dd30eb1 ]
ADMV8818_SW_IN_WR0_MSK and ADMV8818_SW_OUT_WR0_MSK have 3 bits,
which means a length of 8, but freq_range_hpf and freq_range_lpf
array size is 4, may end up reading 4 elements beyond the end of
those arrays.
Check value first before access freq_range_hpf and freq_range_lpf
to harden against the hardware allowing out of range values.
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Link: https://lore.kernel.org/r/20220922115848.1800021-1-weiyongjun@huaweicloud.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/filter/admv8818.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/filter/admv8818.c b/drivers/iio/filter/admv8818.c
index 68de45fe21b4..fe8d46cb7f1d 100644
--- a/drivers/iio/filter/admv8818.c
+++ b/drivers/iio/filter/admv8818.c
@@ -265,7 +265,7 @@ static int __admv8818_read_hpf_freq(struct admv8818_state *st, u64 *hpf_freq)
return ret;
hpf_band = FIELD_GET(ADMV8818_SW_IN_WR0_MSK, data);
- if (!hpf_band) {
+ if (!hpf_band || hpf_band > 4) {
*hpf_freq = 0;
return ret;
}
@@ -303,7 +303,7 @@ static int __admv8818_read_lpf_freq(struct admv8818_state *st, u64 *lpf_freq)
return ret;
lpf_band = FIELD_GET(ADMV8818_SW_OUT_WR0_MSK, data);
- if (!lpf_band) {
+ if (!lpf_band || lpf_band > 4) {
*lpf_freq = 0;
return ret;
}
--
2.35.1
^ permalink raw reply related [flat|nested] only message in thread