]> www.infradead.org Git - users/jedix/linux-maple.git/commit
iio: adc: ad4695: fix out of bounds array access
authorDavid Lechner <dlechner@baylibre.com>
Tue, 18 Feb 2025 23:17:45 +0000 (17:17 -0600)
committerJonathan Cameron <Jonathan.Cameron@huawei.com>
Tue, 4 Mar 2025 13:17:50 +0000 (13:17 +0000)
commitcafeb8a99746e218035ad000d28deeca2bad9f9c
treea30bcde5fea48d3ecce5fe640e545a9b5d05b885
parentd477cda71a3a502113b81e9d1f07948624a2f8a5
iio: adc: ad4695: fix out of bounds array access

Fix some out of bounds array access of st->channels_cfg in the ad4695
driver. This array only has elements for voltage channels, but it was
also being accessed for the temperature channel in a few cases causing
reading past the end of the array.

In some cases, this was harmless because the value was read but not
used. However, the in_temp_sampling_frequency attribute shares code
with the in_voltageY_sampling_frequency attributes and was trying to
read the oversampling ratio from the st->channels_cfg array. This
resulted in a garbage value being used in the calculation and the
resulting in_temp_sampling_frequency value was incorrect.

To fix, make sure we always check that we are dealing with a voltage
channel before accessing the st->channels_cfg array and use an
oversampling ratio of 1 for the temperature channel (multiplicative
identity value) since that channel doesn't support oversampling.

Fixes: 67d63185db79 ("iio: adc: ad4695: add offload-based oversampling support")
Signed-off-by: David Lechner <dlechner@baylibre.com>
Reviewed-by: Trevor Gamblin <tgamblin@baylibre.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Link: https://patch.msgid.link/20250218-iio-adc-ad4695-fix-out-of-bounds-array-access-v1-1-57fef8c7a3fd@baylibre.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
drivers/iio/adc/ad4695.c