From patchwork Mon May 31 13:13:24 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 450506 Delivered-To: patch@linaro.org Received: by 2002:a02:c735:0:0:0:0:0 with SMTP id h21csp873413jao; Mon, 31 May 2021 07:20:58 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyDRHjGlkCOtOi1pUv8Tr96kLxAv9IZ6lN76H0zXqfzthziQVTOQz6uW8736m689Cm89yXh X-Received: by 2002:a92:6c0f:: with SMTP id h15mr17204557ilc.19.1622470858417; Mon, 31 May 2021 07:20:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1622470858; cv=none; d=google.com; s=arc-20160816; b=mJCr3ifeet7wYeqxdUrEAVvl9hYKiuxTJfo+ryCmp0COuttxZIcqnMz2NpcDhSlxsE sMxNJk/Xcvg+cL4UGWvErlY1qf1Kfjz1apSC/FuumIOgVHdDnrmgUrB4W4vzCNGH/9Z0 /GYoTG+VnwbmhF0megbXZzGJyFrA2ExGlwrDEwgCrLaBMJdzMO10v0ZqEdi6JMRwdnQQ 1kCWmCeo7XfstzRGqkmT7DKoe+H930VD+jmfdJy5TCyixv8gg3NdC7vnWP/SfStYLc59 TioljVNdpyjHtXYstrtlu2LQy2mZmHbPPOJV/EanuoQnSLD9vYcVZyA7R2+xUCy4Zx09 KaFA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=OMn86vzcfvp9mGbYWy+D+rQrG4gKRcnp4CNpNM3kB78=; b=xSHA+6CzKag1Bw5vl1ZtlmreG3AWJYfGINn1AJ2/ig2FQ5J63xGPpS66PXppV2iVmq 9yG+qWjG9uWzyQ1cAE0KmcS/gyAxGhOHaKZ1Lb+lQYGrG955IkYXzgbYQU+hnWtgaqqg yUuBqw18XTpguGd0/XT8lFveFmrJFggni65L6k0fTKO7Wxnpdqpc5PdNsag0mdXD3gFG ollLWWb94wW2I9GeOBjMx5hF1Motgfb616kekHmM+2WcswG9KhK+5QNoqunxfKzMIaam E4GdgFO6TSCOPnPCHXVqQs+pPHL+KOdq68hGbX03jStscRhqmwE8GS7Jh/UwwAskHVeo Umjw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=N3RdRscC; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id w31si13894016jal.77.2021.05.31.07.20.58; Mon, 31 May 2021 07:20:58 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=N3RdRscC; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232123AbhEaOWc (ORCPT + 12 others); Mon, 31 May 2021 10:22:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:43916 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233237AbhEaOQ4 (ORCPT ); Mon, 31 May 2021 10:16:56 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id EAFBB61483; Mon, 31 May 2021 13:43:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1622468603; bh=P5J+fU+9gaBNgUgKE/RpVtOa9cecFo5mxU4RJjIqx6U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=N3RdRscCwhFWNmPBpePRzLP6eEUs4C8n6XOk5YnKIr3RPnvP5ec+jF4TK2sg2aQ0Y vTnFuTTXcHJOKlqNoPHcSV4X3i2EZpFhhLE0J3+lcfCrutWdkk+CgM9KaiRoPEtLg5 DBdi4ar0cm+T6f+6cnTvezPA51NRxPGDmiMQrVKU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexandru Ardelean , Jonathan Cameron , Alexandru Ardelean , Stable@vger.kernel.org Subject: [PATCH 5.4 047/177] iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers Date: Mon, 31 May 2021 15:13:24 +0200 Message-Id: <20210531130649.545479156@linuxfoundation.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210531130647.887605866@linuxfoundation.org> References: <20210531130647.887605866@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jonathan Cameron commit f2a772c51206b0c3f262e4f6a3812c89a650191b upstream. Channel numbering must start at 0 and then not have any holes, or it is possible to overflow the available storage. Note this bug was introduced as part of a fix to ensure we didn't rely on the ordering of child nodes. So we need to support arbitrary ordering but they all need to be there somewhere. Note I hit this when using qemu to test the rest of this series. Arguably this isn't the best fix, but it is probably the most minimal option for backporting etc. Alexandru's sign-off is here because he carried this patch in a larger set that Jonathan then applied. Fixes: d7857e4ee1ba6 ("iio: adc: ad7124: Fix DT channel configuration") Reviewed-by: Alexandru Ardelean Signed-off-by: Jonathan Cameron Signed-off-by: Alexandru Ardelean Cc: Signed-off-by: Greg Kroah-Hartman --- drivers/iio/adc/ad7124.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/drivers/iio/adc/ad7124.c +++ b/drivers/iio/adc/ad7124.c @@ -473,6 +473,13 @@ static int ad7124_of_parse_channel_confi if (ret) goto err; + if (channel >= indio_dev->num_channels) { + dev_err(indio_dev->dev.parent, + "Channel index >= number of channels\n"); + ret = -EINVAL; + goto err; + } + ret = of_property_read_u32_array(child, "diff-channels", ain, 2); if (ret)