lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

staging: iio: adc: ad799x: prevent buffer overflow

Browse Source 
ring->access.read_last() reads the entire datum from the ring including padding and time stamp.

Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Michael Hennerich
2010-10-06 16:22:17 +02:00
committed by Greg Kroah-Hartman
parent 5a505da957
commit 858f1ccff1
1 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/staging/iio/adc/ad799x_ring.c
View File

@@ -29,28 +29,26 @@
int ad799x_single_channel_from_ring(struct ad799x_state *st, long mask) int ad799x_single_channel_from_ring(struct ad799x_state *st, long mask)
{ {
unsigned long numvals; struct iio_ring_buffer *ring = st->indio_dev->ring;
int count = 0, ret; int count = 0, ret;
u16 *ring_data; u16 *ring_data;
if (!(st->indio_dev->ring->scan_mask & mask)) { if (!(ring->scan_mask & mask)) {
ret = -EBUSY; ret = -EBUSY;
goto error_ret; goto error_ret;
} }
numvals = st->indio_dev->ring->scan_count;
ring_data = kmalloc(numvals*2, GFP_KERNEL); ring_data = kmalloc(ring->access.get_bytes_per_datum(ring), GFP_KERNEL);
if (ring_data == NULL) { if (ring_data == NULL) {
ret = -ENOMEM; ret = -ENOMEM;
goto error_ret; goto error_ret;
} }
ret = st->indio_dev->ring->access.read_last(st->indio_dev->ring, ret = ring->access.read_last(ring, (u8 *) ring_data);
(u8 *) ring_data);
if (ret) if (ret)
goto error_free_ring_data; goto error_free_ring_data;
/* Need a count of channels prior to this one */ /* Need a count of channels prior to this one */
mask >>= 1; mask >>= 1;
while (mask) { while (mask) {
if (mask & st->indio_dev->ring->scan_mask) if (mask & ring->scan_mask)
count++; count++;
mask >>= 1; mask >>= 1;
} }