Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 82a005bf authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

iio: ssp_sensors: add more range checking in ssp_parse_dataframe() 



commit 8167c9a375ccceed19048ad9d68cb2d02ed276e0 upstream.

The "idx" is validated at the start of the loop but it gets incremented
during the iteration so it needs to be checked again.

Fixes: 50dd64d5 ("iio: common: ssp_sensors: Add sensorhub driver")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20210909091336.GA26312@kili


Cc: <Stable@vger.kernel.org>
Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7e185b64

drivers/iio/common/ssp_sensors/ssp_spi.c

+8 −1
Original line number Original line Diff line number Diff line
@@ -283,6 +283,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len) 
	for (idx = 0; idx < len;) {

	for (idx = 0; idx < len;) {

		switch (dataframe[idx++]) {

		switch (dataframe[idx++]) {

		case SSP_MSG2AP_INST_BYPASS_DATA:

		case SSP_MSG2AP_INST_BYPASS_DATA:

			if (idx >= len)

				return -EPROTO;

			sd = dataframe[idx++];

			sd = dataframe[idx++];

			if (sd < 0 || sd >= SSP_SENSOR_MAX) {

			if (sd < 0 || sd >= SSP_SENSOR_MAX) {

				dev_err(SSP_DEV,

				dev_err(SSP_DEV,
@@ -292,10 +294,13 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len) 




			if (indio_devs[sd]) {

			if (indio_devs[sd]) {

				spd = iio_priv(indio_devs[sd]);

				spd = iio_priv(indio_devs[sd]);

				if (spd->process_data)

				if (spd->process_data) {

					if (idx >= len)

						return -EPROTO;

					spd->process_data(indio_devs[sd],

					spd->process_data(indio_devs[sd],

							  &dataframe[idx],

							  &dataframe[idx],

							  data->timestamp);

							  data->timestamp);

				}

			} else {

			} else {

				dev_err(SSP_DEV, "no client for frame\n");

				dev_err(SSP_DEV, "no client for frame\n");

			}

			}
@@ -303,6 +308,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len) 
			idx += ssp_offset_map[sd];

			idx += ssp_offset_map[sd];

			break;

			break;

		case SSP_MSG2AP_INST_DEBUG_DATA:

		case SSP_MSG2AP_INST_DEBUG_DATA:

			if (idx >= len)

				return -EPROTO;

			sd = ssp_print_mcu_debug(dataframe, &idx, len);

			sd = ssp_print_mcu_debug(dataframe, &idx, len);

			if (sd) {

			if (sd) {

				dev_err(SSP_DEV,

				dev_err(SSP_DEV,