In sca3000_store_measurement_mode() we use val to and it with a mask.
This mask is only two bits long (as we are only interested in the
lowest two bits), so a value bigger than 3 was silently ignored so
far.
Now this function will return -EINVAL, if val is bigger than 3.
Signed-off-by: Andreas Ruprecht <rupran@xxxxxxxxxxxx>
Acked-by: Jonathan Cameron <jic23@xxxxxxxxxx>
---
drivers/staging/iio/accel/sca3000_core.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/drivers/staging/iio/accel/sca3000_core.c b/drivers/staging/iio/accel/sca3000_core.c
index a33e742..052005c 100644
--- a/drivers/staging/iio/accel/sca3000_core.c
+++ b/drivers/staging/iio/accel/sca3000_core.c
@@ -388,6 +388,10 @@ sca3000_store_measurement_mode(struct device *dev,
ret = kstrtou8(buf, 10, &val);
if (ret)
goto error_ret;
+ if (val > 3) {
+ ret = -EINVAL;
+ goto error_ret;
+ }
ret = sca3000_read_data_short(st, SCA3000_REG_ADDR_MODE, 1);
if (ret)
goto error_ret;
--
1.7.5.4
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
