Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7c9e1873 authored by qctecmdr Service's avatar qctecmdr Service Committed by Gerrit - the friendly Code Review server
Browse files

Merge "iio: adc: Fix buffer overflow in adc_configure"

parents 3255ed11 1951816b
Loading
Loading
Loading
Loading
+6 −4
Original line number Diff line number Diff line
/*
 * Copyright (c) 2018, The Linux Foundation. All rights reserved.
 * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 and
@@ -457,11 +457,13 @@ static int adc_pre_configure_usb_in_read(struct adc_chip *adc)
	return adc_write(adc, ADC_USR_CONV_REQ, &data, 1);
}

#define ADC5_MULTI_TRANSFER	5

static int adc_configure(struct adc_chip *adc,
			struct adc_channel_prop *prop)
{
	int ret;
	u8 buf[5];
	u8 buf[ADC5_MULTI_TRANSFER];
	u8 conv_req = 0;
	bool channel_check = false;

@@ -470,7 +472,7 @@ static int adc_configure(struct adc_chip *adc,
			channel_check = true;

	/* Read registers 0x42 through 0x46 */
	ret = adc_read(adc, ADC_USR_DIG_PARAM, buf, 6);
	ret = adc_read(adc, ADC_USR_DIG_PARAM, buf, ADC5_MULTI_TRANSFER);
	if (ret < 0)
		return ret;

@@ -497,7 +499,7 @@ static int adc_configure(struct adc_chip *adc,
	if (!adc->poll_eoc)
		reinit_completion(&adc->complete);

	ret = adc_write(adc, ADC_USR_DIG_PARAM, buf, 5);
	ret = adc_write(adc, ADC_USR_DIG_PARAM, buf, ADC5_MULTI_TRANSFER);
	if (ret)
		return ret;