On Tue, 2 Jan 2024 09:07:11 +0800
zhouzhouyi@xxxxxxxxx wrote:
> From: "zhili.liu" <zhili.liu@xxxxxxxxxxx>
>
> Recently, we encounter kernel crash in function rm3100_common_probe
> caused by out of bound access of array rm3100_samp_rates (because of
> underlying hardware failures). Add boundary check to prevent out of
> bound access.
>
> Fixes: 121354b2eceb ("iio: magnetometer: Add driver support for PNI RM3100")
Fixes is a formal tag so needs to be part of the main tags block
(i.e. No blank line here!)
I'll fix that whilst applying.
>
> Suggested-by: Zhouyi Zhou <zhouzhouyi@xxxxxxxxx>
> Signed-off-by: zhili.liu <zhili.liu@xxxxxxxxxxx>
> ---
> drivers/iio/magnetometer/rm3100-core.c | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/iio/magnetometer/rm3100-core.c b/drivers/iio/magnetometer/rm3100-core.c
> index 69938204456f..12c2e3b0aeb6 100644
> --- a/drivers/iio/magnetometer/rm3100-core.c
> +++ b/drivers/iio/magnetometer/rm3100-core.c
> @@ -530,6 +530,7 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq)
> struct rm3100_data *data;
> unsigned int tmp;
> int ret;
> + int samp_rate_index;
>
> indio_dev = devm_iio_device_alloc(dev, sizeof(*data));
> if (!indio_dev)
> @@ -586,8 +587,14 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq)
> ret = regmap_read(regmap, RM3100_REG_TMRC, &tmp);
> if (ret < 0)
> return ret;
> +
> + samp_rate_index = tmp - RM3100_TMRC_OFFSET;
> + if (samp_rate_index < 0 || samp_rate_index >= RM3100_SAMP_NUM) {
> + dev_err(dev, "The value read from RM3100_REG_TMRC is invalid!\n");
> + return -EINVAL;
> + }
> /* Initializing max wait time, which is double conversion time. */
> - data->conversion_time = rm3100_samp_rates[tmp - RM3100_TMRC_OFFSET][2]
> + data->conversion_time = rm3100_samp_rates[samp_rate_index][2]
> * 2;
I've rewrapped this to be on one line whilst applying. Make sure to check for
side effects like this when updating code. If we don't tidy it up at the time
we end up with gradually worse formatting over a long period!
Applied to the fixes-togreg branch of iio.git and marked for stable.
Thanks,
Jonathan
>
> /* Cycle count values may not be what we want. */
