Messages in this thread Patch in this message | | | Date | Tue, 7 Apr 2020 12:29:35 +0300 | From | Dan Carpenter <> | Subject | [PATCH] platform/chrome: cros_ec_sensorhub: Off by one in cros_sensorhub_send_sample() |
| |
The sensorhub->push_data[] array has sensorhub->sensor_num elements. It's allocated in cros_ec_sensorhub_ring_add(). So the > should be >= to prevent a read one element beyond the end of the array.
Fixes: 145d59baff59 ("platform/chrome: cros_ec_sensorhub: Add FIFO support") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c index 230e6cf3da2f..85e8ba782f0c 100644 --- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c +++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c @@ -40,7 +40,7 @@ cros_sensorhub_send_sample(struct cros_ec_sensorhub *sensorhub, int id = sample->sensor_id; struct iio_dev *indio_dev; - if (id > sensorhub->sensor_num) + if (id >= sensorhub->sensor_num) return -EINVAL; cb = sensorhub->push_data[id].push_data_cb; -- 2.25.1
| |