diff options
| author |   Alexandru Ardelean <alexandru.ardelean@analog.com> | 2019-08-16 09:28:35 +0300 |
|---|---|---|
| committer |   Jonathan Cameron <Jonathan.Cameron@huawei.com> | 2019-08-18 18:53:15 +0100 |
| commit | 519808425e1941563ca25af5caefe7261f6cc8a4 (patch) | |
| tree | 59dfa7f7837bb75931c3f4a0919145301093a00d /drivers/iio | |
| parent | iio: accel: kxcjk1013: Improve comments on KIOX010A and KIOX020A ACPI ids (diff) | |
| download | linux-dev-519808425e1941563ca25af5caefe7261f6cc8a4.tar.xz linux-dev-519808425e1941563ca25af5caefe7261f6cc8a4.zip | |
iio: imu: adis16460: fix variable signedness
Caught via static-analysis checker:
```
drivers/iio/imu/adis16460.c
152 static int adis16460_set_freq(struct iio_dev *indio_dev, int val, int val2)
153 {
154 struct adis16460 *st = iio_priv(indio_dev);
155 unsigned int t;
^^^^^^^^^^^^^^
156
157 t = val * 1000 + val2 / 1000;
158 if (t <= 0)
^^^^^^
Unsigned is not less than zero.
```
The types of `val` && `val2` are obtained from the IIO `write_raw` hook, so
userspace can provide negative values, which can cause weird behavior after
conversion to unsigned.
This patch changes the sign of variable `t` so that -EINVAL will be
returned for negative values as well.
Fixes: db6ed4d23dd1 ("iio: imu: Add support for the ADIS16460 IMU")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Diffstat (limited to 'drivers/iio')
| -rw-r--r-- | drivers/iio/imu/adis16460.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/iio/imu/adis16460.c b/drivers/iio/imu/adis16460.c index 1ef11640ee20..6aed9e84abbf 100644 --- a/drivers/iio/imu/adis16460.c +++ b/drivers/iio/imu/adis16460.c @@ -152,7 +152,7 @@ static int adis16460_debugfs_init(struct iio_dev *indio_dev) static int adis16460_set_freq(struct iio_dev *indio_dev, int val, int val2) { struct adis16460 *st = iio_priv(indio_dev); - unsigned int t; + int t; t = val * 1000 + val2 / 1000; if (t <= 0) |