Commit b7a78a8a authored by Oleksij Rempel's avatar Oleksij Rempel Committed by Jonathan Cameron
Browse files

iio: adc: tsc2046: fix memory corruption by preventing array overflow 



On one side we have indio_dev->num_channels includes all physical channels +
timestamp channel. On other side we have an array allocated only for
physical channels. So, fix memory corruption by ARRAY_SIZE() instead of
num_channels variable.

Note the first case is a cleanup rather than a fix as the software
timestamp channel bit in active_scanmask is never set by the IIO core.

Fixes: 9374e8f5 ("iio: adc: add ADC driver for the TI TSC2046 controller")
Signed-off-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20220107081401.2816357-1-o.rempel@pengutronix.de


Cc: <Stable@vger.kernel.org>
Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
parent e783362e

drivers/iio/adc/ti-tsc2046.c

+2 −2
Original line number Diff line number Diff line
@@ -388,7 +388,7 @@ static int tsc2046_adc_update_scan_mode(struct iio_dev *indio_dev, 
	mutex_lock(&priv->slock);



	size = 0;

	for_each_set_bit(ch_idx, active_scan_mask, indio_dev->num_channels) {

	for_each_set_bit(ch_idx, active_scan_mask, ARRAY_SIZE(priv->l)) {

		size += tsc2046_adc_group_set_layout(priv, group, ch_idx);

		tsc2046_adc_group_set_cmd(priv, group, ch_idx);

		group++;
@@ -548,7 +548,7 @@ static int tsc2046_adc_setup_spi_msg(struct tsc2046_adc_priv *priv) 
	 * enabled.

	 */

	size = 0;

	for (ch_idx = 0; ch_idx < priv->dcfg->num_channels; ch_idx++)

	for (ch_idx = 0; ch_idx < ARRAY_SIZE(priv->l); ch_idx++)

		size += tsc2046_adc_group_set_layout(priv, ch_idx, ch_idx);



	priv->tx = devm_kzalloc(&priv->spi->dev, size, GFP_KERNEL);