lkml.org 
[lkml]   [2021]   [Oct]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 079/151] iio: ssp_sensors: add more range checking in ssp_parse_dataframe()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit 8167c9a375ccceed19048ad9d68cb2d02ed276e0 upstream.

    The "idx" is validated at the start of the loop but it gets incremented
    during the iteration so it needs to be checked again.

    Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Link: https://lore.kernel.org/r/20210909091336.GA26312@kili
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/iio/common/ssp_sensors/ssp_spi.c | 9 ++++++++-
    1 file changed, 8 insertions(+), 1 deletion(-)

    --- a/drivers/iio/common/ssp_sensors/ssp_spi.c
    +++ b/drivers/iio/common/ssp_sensors/ssp_spi.c
    @@ -273,6 +273,8 @@ static int ssp_parse_dataframe(struct ss
    for (idx = 0; idx < len;) {
    switch (dataframe[idx++]) {
    case SSP_MSG2AP_INST_BYPASS_DATA:
    + if (idx >= len)
    + return -EPROTO;
    sd = dataframe[idx++];
    if (sd < 0 || sd >= SSP_SENSOR_MAX) {
    dev_err(SSP_DEV,
    @@ -282,10 +284,13 @@ static int ssp_parse_dataframe(struct ss

    if (indio_devs[sd]) {
    spd = iio_priv(indio_devs[sd]);
    - if (spd->process_data)
    + if (spd->process_data) {
    + if (idx >= len)
    + return -EPROTO;
    spd->process_data(indio_devs[sd],
    &dataframe[idx],
    data->timestamp);
    + }
    } else {
    dev_err(SSP_DEV, "no client for frame\n");
    }
    @@ -293,6 +298,8 @@ static int ssp_parse_dataframe(struct ss
    idx += ssp_offset_map[sd];
    break;
    case SSP_MSG2AP_INST_DEBUG_DATA:
    + if (idx >= len)
    + return -EPROTO;
    sd = ssp_print_mcu_debug(dataframe, &idx, len);
    if (sd) {
    dev_err(SSP_DEV,

    \
     
     \ /
      Last update: 2021-10-18 15:56    [W:2.573 / U:0.544 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site