From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965367AbcKXNjJ (ORCPT ); Thu, 24 Nov 2016 08:39:09 -0500 Received: from aserp1040.oracle.com ([141.146.126.69]:27561 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965137AbcKXNjH (ORCPT ); Thu, 24 Nov 2016 08:39:07 -0500 Date: Thu, 24 Nov 2016 16:38:07 +0300 From: Dan Carpenter To: Jonathan Cameron Cc: Hartmut Knaack , Lars-Peter Clausen , Peter Meerwald-Stadler , Brian Masney , Greg Kroah-Hartman , Eva Rachel Retuya , linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] iio: tsl2583: make array large enough Message-ID: <20161124133807.GA32255@mwanda> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20161118140326.GA20458@basecamp.onstation.org> User-Agent: Mutt/1.6.0 (2016-04-01) X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This array is supposed to have 10 elements. Smatch complains that with the current code we can have n == max_ints and read beyond the end of the array. Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver") Signed-off-by: Dan Carpenter diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c index 0b87f6a..a78b602 100644 --- a/drivers/iio/light/tsl2583.c +++ b/drivers/iio/light/tsl2583.c @@ -565,7 +565,7 @@ static ssize_t in_illuminance_lux_table_store(struct device *dev, struct iio_dev *indio_dev = dev_to_iio_dev(dev); struct tsl2583_chip *chip = iio_priv(indio_dev); const unsigned int max_ints = TSL2583_MAX_LUX_TABLE_ENTRIES * 3; - int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3]; + int value[TSL2583_MAX_LUX_TABLE_ENTRIES * 3 + 1]; int ret = -EINVAL; unsigned int n;