Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1951816b authored by Siddartha Mohanadoss's avatar Siddartha Mohanadoss
Browse files

iio: adc: Fix buffer overflow in adc_configure 



Update buffer size to avoid buffer overflow when
issuing multi byte SPMI reads.

Change-Id: I1a5a1b75b8ae9f4db9f79ff5a272f8acfbd099f2
Signed-off-by: default avatarSiddartha Mohanadoss <smohanad@codeaurora.org>
parent 0c098091

drivers/iio/adc/qcom-spmi-adc5.c

+6 −4
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2018, The Linux Foundation. All rights reserved.

 * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -457,11 +457,13 @@ static int adc_pre_configure_usb_in_read(struct adc_chip *adc) 
	return adc_write(adc, ADC_USR_CONV_REQ, &data, 1);

}



#define ADC5_MULTI_TRANSFER	5



static int adc_configure(struct adc_chip *adc,

			struct adc_channel_prop *prop)

{

	int ret;

	u8 buf[5];

	u8 buf[ADC5_MULTI_TRANSFER];

	u8 conv_req = 0;

	bool channel_check = false;
@@ -470,7 +472,7 @@ static int adc_configure(struct adc_chip *adc, 
			channel_check = true;



	/* Read registers 0x42 through 0x46 */

	ret = adc_read(adc, ADC_USR_DIG_PARAM, buf, 6);

	ret = adc_read(adc, ADC_USR_DIG_PARAM, buf, ADC5_MULTI_TRANSFER);

	if (ret < 0)

		return ret;
@@ -497,7 +499,7 @@ static int adc_configure(struct adc_chip *adc, 
	if (!adc->poll_eoc)

		reinit_completion(&adc->complete);



	ret = adc_write(adc, ADC_USR_DIG_PARAM, buf, 5);

	ret = adc_write(adc, ADC_USR_DIG_PARAM, buf, ADC5_MULTI_TRANSFER);

	if (ret)

		return ret;