Commit 3f4033a8 authored by Wei Yongjun's avatar Wei Yongjun Committed by Jonathan Cameron
Browse files

iio: filter: admv8818: close potential out-of-bounds read in __admv8818_read_[h|l]pf_freq() 



ADMV8818_SW_IN_WR0_MSK and ADMV8818_SW_OUT_WR0_MSK have 3 bits,
which means a length of 8, but freq_range_hpf and freq_range_lpf
array size is 4, may end up reading 4 elements beyond the end of
those arrays.

Check value first before access freq_range_hpf and freq_range_lpf
to harden against the hardware allowing out of range values.

Signed-off-by: default avatarWei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: default avatarAntoniu Miclaus <antoniu.miclaus@analog.com>
Link: https://lore.kernel.org/r/20220922115848.1800021-1-weiyongjun@huaweicloud.com


Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
parent 8cf5f032

drivers/iio/filter/admv8818.c

+2 −2
Original line number Diff line number Diff line
@@ -265,7 +265,7 @@ static int __admv8818_read_hpf_freq(struct admv8818_state *st, u64 *hpf_freq) 
		return ret;



	hpf_band = FIELD_GET(ADMV8818_SW_IN_WR0_MSK, data);

	if (!hpf_band) {

	if (!hpf_band || hpf_band > 4) {

		*hpf_freq = 0;

		return ret;

	}
@@ -303,7 +303,7 @@ static int __admv8818_read_lpf_freq(struct admv8818_state *st, u64 *lpf_freq) 
		return ret;



	lpf_band = FIELD_GET(ADMV8818_SW_OUT_WR0_MSK, data);

	if (!lpf_band) {

	if (!lpf_band || lpf_band > 4) {

		*lpf_freq = 0;

		return ret;

	}