Commit 8167c9a3 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jonathan Cameron
Browse files

iio: ssp_sensors: add more range checking in ssp_parse_dataframe() 



The "idx" is validated at the start of the loop but it gets incremented
during the iteration so it needs to be checked again.

Fixes: 50dd64d5 ("iio: common: ssp_sensors: Add sensorhub driver")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20210909091336.GA26312@kili


Cc: <Stable@vger.kernel.org>
Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
parent 4170d3dd

drivers/iio/common/ssp_sensors/ssp_spi.c

+8 −1
Original line number Diff line number Diff line
@@ -273,6 +273,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len) 
	for (idx = 0; idx < len;) {

		switch (dataframe[idx++]) {

		case SSP_MSG2AP_INST_BYPASS_DATA:

			if (idx >= len)

				return -EPROTO;

			sd = dataframe[idx++];

			if (sd < 0 || sd >= SSP_SENSOR_MAX) {

				dev_err(SSP_DEV,
@@ -282,10 +284,13 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len) 


			if (indio_devs[sd]) {

				spd = iio_priv(indio_devs[sd]);

				if (spd->process_data)

				if (spd->process_data) {

					if (idx >= len)

						return -EPROTO;

					spd->process_data(indio_devs[sd],

							  &dataframe[idx],

							  data->timestamp);

				}

			} else {

				dev_err(SSP_DEV, "no client for frame\n");

			}
@@ -293,6 +298,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len) 
			idx += ssp_offset_map[sd];

			break;

		case SSP_MSG2AP_INST_DEBUG_DATA:

			if (idx >= len)

				return -EPROTO;

			sd = ssp_print_mcu_debug(dataframe, &idx, len);

			if (sd) {

				dev_err(SSP_DEV,