Commit b4d8b164 authored by Zicheng Qu's avatar Zicheng Qu Committed by Liao Chen
Browse files

ad7780: fix division by zero in ad7780_write_raw() 

stable inclusion
from stable-v5.10.231
commit afc1e3c00b3f5f0b4f1bc3e974fb9803cb938a90
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMC
CVE: CVE-2024-56567

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=afc1e3c00b3f5f0b4f1bc3e974fb9803cb938a90



--------------------------------

commit c174b53e95adf2eece2afc56cd9798374919f99a upstream.

In the ad7780_write_raw() , val2 can be zero, which might lead to a
division by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw()
is based on iio_info's write_raw. While val is explicitly declared that
can be zero (in read mode), val2 is not specified to be non-zero.

Fixes: 9085daa4 ("staging: iio: ad7780: add gain & filter gpio support")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarZicheng Qu <quzicheng@huawei.com>
Link: https://patch.msgid.link/20241028142027.1032332-1-quzicheng@huawei.com


Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarLiao Chen <liaochen4@huawei.com>
parent d51fb86c

drivers/iio/adc/ad7780.c

+1 −1
Original line number Diff line number Diff line
@@ -152,7 +152,7 @@ static int ad7780_write_raw(struct iio_dev *indio_dev, 


	switch (m) {

	case IIO_CHAN_INFO_SCALE:

		if (val != 0)

		if (val != 0 || val2 == 0)

			return -EINVAL;



		vref = st->int_vref_mv * 1000000LL;