Commit eda7d0f3 authored Aug 08, 2015 by Dan Carpenter Committed by Jonathan Cameron Oct 03, 2015

iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb()



"num_read" is in byte units but we are write u16s so we end up write
twice as much as intended.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>

parent 61fd5630

drivers/staging/iio/accel/sca3000_ring.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -116,7 +116,7 @@ static int sca3000_read_first_n_hw_rb(struct iio_buffer *r,
		if (ret)
		goto error_ret;

		for (i = 0; i < num_read; i++)
		for (i = 0; i < num_read / sizeof(u16); i++)
		(((u16 )rx) + i) = be16_to_cpup((__be16 *)rx + i);

		if (copy_to_user(buf, rx, num_read))