Commit c043a486 authored by Javier Carrasco's avatar Javier Carrasco Committed by Luo Gengkun
Browse files

iio: light: veml6030: fix IIO device retrieval from embedded device 

stable inclusion
from stable-v5.10.228
commit bf3ab8e1c28f10df0823d4ff312f83c952b06a15
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWA
CVE: CVE-2024-50198

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=bf3ab8e1c28f10df0823d4ff312f83c952b06a15



--------------------------------

commit c7c44e57750c31de43906d97813273fdffcf7d02 upstream.

The dev pointer that is received as an argument in the
in_illuminance_period_available_show function references the device
embedded in the IIO device, not in the i2c client.

dev_to_iio_dev() must be used to accessthe right data. The current
implementation leads to a segmentation fault on every attempt to read
the attribute because indio_dev gets a NULL assignment.

This bug has been present since the first appearance of the driver,
apparently since the last version (V6) before getting applied. A
constant attribute was used until then, and the last modifications might
have not been tested again.

Cc: stable@vger.kernel.org
Fixes: 7b779f57 ("iio: light: add driver for veml6030 ambient light sensor")
Signed-off-by: default avatarJavier Carrasco <javier.carrasco.cruz@gmail.com>
Link: https://patch.msgid.link/20240913-veml6035-v1-3-0b09c0c90418@gmail.com


Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: default avatarLuo Gengkun <luogengkun2@huawei.com>
parent 400fd9cc

drivers/iio/light/veml6030.c

+1 −2
Original line number Diff line number Diff line
@@ -99,9 +99,8 @@ static const char * const period_values[] = { 
static ssize_t in_illuminance_period_available_show(struct device *dev,

				struct device_attribute *attr, char *buf)

{

	struct veml6030_data *data = iio_priv(dev_to_iio_dev(dev));

	int ret, reg, x;

	struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));

	struct veml6030_data *data = iio_priv(indio_dev);



	ret = regmap_read(data->regmap, VEML6030_REG_ALS_CONF, &reg);

	if (ret) {