* [PATCH] platform/chrome: cros_ec_sensorhub: Off by one in cros_sensorhub_send_sample()
@ 2020-04-07 9:29 Dan Carpenter
2020-04-07 14:04 ` Guenter Roeck
2020-04-13 14:34 ` Enric Balletbo i Serra
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2020-04-07 9:29 UTC (permalink / raw)
To: Benson Leung, Gwendal Grignou
Cc: Enric Balletbo i Serra, Guenter Roeck, linux-kernel, kernel-janitors
The sensorhub->push_data[] array has sensorhub->sensor_num elements.
It's allocated in cros_ec_sensorhub_ring_add(). So the > should be >=
to prevent a read one element beyond the end of the array.
Fixes: 145d59baff59 ("platform/chrome: cros_ec_sensorhub: Add FIFO support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/platform/chrome/cros_ec_sensorhub_ring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
index 230e6cf3da2f..85e8ba782f0c 100644
--- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c
+++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
@@ -40,7 +40,7 @@ cros_sensorhub_send_sample(struct cros_ec_sensorhub *sensorhub,
int id = sample->sensor_id;
struct iio_dev *indio_dev;
- if (id > sensorhub->sensor_num)
+ if (id >= sensorhub->sensor_num)
return -EINVAL;
cb = sensorhub->push_data[id].push_data_cb;
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] platform/chrome: cros_ec_sensorhub: Off by one in cros_sensorhub_send_sample()
2020-04-07 9:29 [PATCH] platform/chrome: cros_ec_sensorhub: Off by one in cros_sensorhub_send_sample() Dan Carpenter
@ 2020-04-07 14:04 ` Guenter Roeck
2020-04-13 14:34 ` Enric Balletbo i Serra
1 sibling, 0 replies; 3+ messages in thread
From: Guenter Roeck @ 2020-04-07 14:04 UTC (permalink / raw)
To: Dan Carpenter
Cc: Benson Leung, Gwendal Grignou, Enric Balletbo i Serra,
Guenter Roeck, linux-kernel, kernel-janitors
On Tue, Apr 7, 2020 at 2:31 AM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> The sensorhub->push_data[] array has sensorhub->sensor_num elements.
> It's allocated in cros_ec_sensorhub_ring_add(). So the > should be >=
> to prevent a read one element beyond the end of the array.
>
> Fixes: 145d59baff59 ("platform/chrome: cros_ec_sensorhub: Add FIFO support")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
> ---
> drivers/platform/chrome/cros_ec_sensorhub_ring.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
> index 230e6cf3da2f..85e8ba782f0c 100644
> --- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c
> +++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
> @@ -40,7 +40,7 @@ cros_sensorhub_send_sample(struct cros_ec_sensorhub *sensorhub,
> int id = sample->sensor_id;
> struct iio_dev *indio_dev;
>
> - if (id > sensorhub->sensor_num)
> + if (id >= sensorhub->sensor_num)
> return -EINVAL;
>
> cb = sensorhub->push_data[id].push_data_cb;
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] platform/chrome: cros_ec_sensorhub: Off by one in cros_sensorhub_send_sample()
2020-04-07 9:29 [PATCH] platform/chrome: cros_ec_sensorhub: Off by one in cros_sensorhub_send_sample() Dan Carpenter
2020-04-07 14:04 ` Guenter Roeck
@ 2020-04-13 14:34 ` Enric Balletbo i Serra
1 sibling, 0 replies; 3+ messages in thread
From: Enric Balletbo i Serra @ 2020-04-13 14:34 UTC (permalink / raw)
To: Dan Carpenter, Benson Leung, Gwendal Grignou
Cc: Guenter Roeck, linux-kernel, kernel-janitors
Hi Dan,
Thank you for your patch.
On 7/4/20 11:29, Dan Carpenter wrote:
> The sensorhub->push_data[] array has sensorhub->sensor_num elements.
> It's allocated in cros_ec_sensorhub_ring_add(). So the > should be >=
> to prevent a read one element beyond the end of the array.
>
> Fixes: 145d59baff59 ("platform/chrome: cros_ec_sensorhub: Add FIFO support")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
Applied as a fix for 5.7
> drivers/platform/chrome/cros_ec_sensorhub_ring.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
> index 230e6cf3da2f..85e8ba782f0c 100644
> --- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c
> +++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
> @@ -40,7 +40,7 @@ cros_sensorhub_send_sample(struct cros_ec_sensorhub *sensorhub,
> int id = sample->sensor_id;
> struct iio_dev *indio_dev;
>
> - if (id > sensorhub->sensor_num)
> + if (id >= sensorhub->sensor_num)
> return -EINVAL;
>
> cb = sensorhub->push_data[id].push_data_cb;
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-04-13 14:35 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-07 9:29 [PATCH] platform/chrome: cros_ec_sensorhub: Off by one in cros_sensorhub_send_sample() Dan Carpenter
2020-04-07 14:04 ` Guenter Roeck
2020-04-13 14:34 ` Enric Balletbo i Serra
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).