Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a79f58e6 authored by Siddartha Mohanadoss's avatar Siddartha Mohanadoss Committed by Gerrit - the friendly Code Review server
Browse files

iio: adc: Fix buffer overflow in adc_configure 



Update buffer size to avoid buffer overflow when
issuing multi byte SPMI reads.

Change-Id: I1a5a1b75b8ae9f4db9f79ff5a272f8acfbd099f2
Signed-off-by: default avatarSiddartha Mohanadoss <smohanad@codeaurora.org>
parent b5131de4

drivers/iio/adc/qcom-spmi-adc5.c

+6 −4
Original line number Original line Diff line number Diff line 
/*

/*

 * Copyright (c) 2018, The Linux Foundation. All rights reserved.

 * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.

 *

 *

 * This program is free software; you can redistribute it and/or modify

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and

 * it under the terms of the GNU General Public License version 2 and
@@ -455,11 +455,13 @@ static int adc_pre_configure_usb_in_read(struct adc_chip *adc) 
	return adc_write(adc, ADC_USR_CONV_REQ, &data, 1);

	return adc_write(adc, ADC_USR_CONV_REQ, &data, 1);

}

}





#define ADC5_MULTI_TRANSFER	5



static int adc_configure(struct adc_chip *adc,

static int adc_configure(struct adc_chip *adc,

			struct adc_channel_prop *prop)

			struct adc_channel_prop *prop)

{

{

	int ret;

	int ret;

	u8 buf[5];

	u8 buf[ADC5_MULTI_TRANSFER];

	u8 conv_req = 0;

	u8 conv_req = 0;

	bool channel_check = false;

	bool channel_check = false;
@@ -468,7 +470,7 @@ static int adc_configure(struct adc_chip *adc, 
			channel_check = true;

			channel_check = true;





	/* Read registers 0x42 through 0x46 */

	/* Read registers 0x42 through 0x46 */

	ret = adc_read(adc, ADC_USR_DIG_PARAM, buf, 6);

	ret = adc_read(adc, ADC_USR_DIG_PARAM, buf, ADC5_MULTI_TRANSFER);

	if (ret < 0)

	if (ret < 0)

		return ret;

		return ret;
@@ -495,7 +497,7 @@ static int adc_configure(struct adc_chip *adc, 
	if (!adc->poll_eoc)

	if (!adc->poll_eoc)

		reinit_completion(&adc->complete);

		reinit_completion(&adc->complete);





	ret = adc_write(adc, ADC_USR_DIG_PARAM, buf, 5);

	ret = adc_write(adc, ADC_USR_DIG_PARAM, buf, ADC5_MULTI_TRANSFER);

	if (ret)

	if (ret)

		return ret;

		return ret;