Messages in this thread | | | From | Guenter Roeck <> | Date | Tue, 7 Apr 2020 07:04:43 -0700 | Subject | Re: [PATCH] platform/chrome: cros_ec_sensorhub: Off by one in cros_sensorhub_send_sample() |
| |
On Tue, Apr 7, 2020 at 2:31 AM Dan Carpenter <dan.carpenter@oracle.com> wrote: > > The sensorhub->push_data[] array has sensorhub->sensor_num elements. > It's allocated in cros_ec_sensorhub_ring_add(). So the > should be >= > to prevent a read one element beyond the end of the array. > > Fixes: 145d59baff59 ("platform/chrome: cros_ec_sensorhub: Add FIFO support") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
> --- > drivers/platform/chrome/cros_ec_sensorhub_ring.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c > index 230e6cf3da2f..85e8ba782f0c 100644 > --- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c > +++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c > @@ -40,7 +40,7 @@ cros_sensorhub_send_sample(struct cros_ec_sensorhub *sensorhub, > int id = sample->sensor_id; > struct iio_dev *indio_dev; > > - if (id > sensorhub->sensor_num) > + if (id >= sensorhub->sensor_num) > return -EINVAL; > > cb = sensorhub->push_data[id].push_data_cb; > -- > 2.25.1 >
| |