From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756573AbcGYWlb (ORCPT ); Mon, 25 Jul 2016 18:41:31 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:56572 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754728AbcGYWlI (ORCPT ); Mon, 25 Jul 2016 18:41:08 -0400 From: Colin King To: Lars-Peter Clausen , Michael Hennerich , Jonathan Cameron , Hartmut Knaack , Peter Meerwald-Stadler , linux-iio@vger.kernel.org Cc: linux-kernel@vger.kernel.org Subject: [PATCH] iio: ad5755: fix off-by-one on devnr limit check Date: Mon, 25 Jul 2016 23:40:01 +0100 Message-Id: <1469486401-17839-1-git-send-email-colin.king@canonical.com> X-Mailer: git-send-email 2.8.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Colin Ian King The comparison for devnr limits is off-by-one, the current check allows 0 to AD5755_NUM_CHANNELS and the limit should be in fact 0 to AD5755_NUM_CHANNELS - 1. This can lead to an out of bounds write to pdata->dac[devnr]. Fix this by replacing > with >= on the comparison. Signed-off-by: Colin Ian King --- drivers/iio/dac/ad5755.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/dac/ad5755.c b/drivers/iio/dac/ad5755.c index 0fde593..5f79682 100644 --- a/drivers/iio/dac/ad5755.c +++ b/drivers/iio/dac/ad5755.c @@ -655,7 +655,7 @@ static struct ad5755_platform_data *ad5755_parse_dt(struct device *dev) devnr = 0; for_each_child_of_node(np, pp) { - if (devnr > AD5755_NUM_CHANNELS) { + if (devnr >= AD5755_NUM_CHANNELS) { dev_err(dev, "There is to many channels defined in DT\n"); goto error_out; -- 2.8.1