diff options
| author |   Wei Yongjun <weiyongjun1@huawei.com> | 2022-11-07 15:20:10 +0000 |
|---|---|---|
| committer |   Jonathan Cameron <Jonathan.Cameron@huawei.com> | 2022-11-12 16:30:23 +0000 |
| commit | fc92d9e3de0b2d30a3ccc08048a5fad533e4672b (patch) | |
| tree | 7bfb5c8858ce63553155a37392dcb6fa54f9b716 /include/uapi/linux/byteorder/ssh:/git: | |
| parent | iio: health: afe4403: Fix oob read in afe4403_read_raw (diff) | |
iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
KASAN report out-of-bounds read as follows:
BUG: KASAN: global-out-of-bounds in afe4404_read_raw+0x2ce/0x380
Read of size 4 at addr ffffffffc00e4658 by task cat/278
Call Trace:
afe4404_read_raw
iio_read_channel_info
dev_attr_show
The buggy address belongs to the variable:
afe4404_channel_leds+0x18/0xffffffffffffe9c0
This issue can be reproduce by singe command:
$ cat /sys/bus/i2c/devices/0-0058/iio\:device0/in_intensity6_raw
The array size of afe4404_channel_leds and afe4404_channel_offdacs
are less than channels, so access with chan->address cause OOB read
in afe4404_[read|write]_raw. Fix it by moving access before use them.
Fixes: b36e8257641a ("iio: health/afe440x: Use regmap fields")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Acked-by: Andrew Davis <afd@ti.com>
Link: https://lore.kernel.org/r/20221107152010.95937-1-weiyongjun@huaweicloud.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Diffstat (limited to 'include/uapi/linux/byteorder/ssh:/git:')
0 files changed, 0 insertions, 0 deletions