[PATCH 3/3] iio: adc: ad7768-1: add bounds check to ad7768_filter_regval_to_type index

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Sam Daly <sam@samdaly.ie>

ad7768_filter_regval_to_type has 12 elements but the combined mask
AD7768_DIG_FIL_EN_60HZ_REJ | AD7768_DIG_FIL_FIL_MSK spans 4 bits
and can yield values 0-15. If it returns a value >= 12, this causes
an out-of-bounds array access. Add a bounds check and return -EINVAL
if the index is out of range.

Assisted-by: gkh_clanker_2000
Cc: stable <stable@kernel.org>
Cc: Lars-Peter Clausen <lars@metafoo.de>
Cc: Michael Hennerich <Michael.Hennerich@analog.com>
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: David Lechner <dlechner@baylibre.com>
Cc: "Nuno Sá" <nuno.sa@analog.com>
Cc: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Sam Daly <sam@samdaly.ie>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/ad7768-1.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
index e16dede687d3..52e95017d36b 100644
--- a/drivers/iio/adc/ad7768-1.c
+++ b/drivers/iio/adc/ad7768-1.c
@@ -897,7 +897,7 @@ static int ad7768_get_filter_type_attr(struct iio_dev *dev,
 {
 	struct ad7768_state *st = iio_priv(dev);
 	int ret;
-	unsigned int mode, mask;
+	unsigned int mode, mask, idx;
 
 	ret = regmap_read(st->regmap, AD7768_REG_DIGITAL_FILTER, &mode);
 	if (ret)
@@ -905,7 +905,11 @@ static int ad7768_get_filter_type_attr(struct iio_dev *dev,
 
 	mask = AD7768_DIG_FIL_EN_60HZ_REJ | AD7768_DIG_FIL_FIL_MSK;
 	/* From the register value, get the corresponding filter type */
-	return ad7768_filter_regval_to_type[FIELD_GET(mask, mode)];
+	idx = FIELD_GET(mask, mode);
+	if (idx >= ARRAY_SIZE(ad7768_filter_regval_to_type))
+		return -EINVAL;
+
+	return ad7768_filter_regval_to_type[idx];
 }
 
 static int ad7768_update_dec_rate(struct iio_dev *dev, unsigned int dec_rate)
-- 
2.54.0