On Wed, 14 Aug 2024 21:19:09 +0200
Marek Vasut <marex@xxxxxxx> wrote:
> The current code is always iterating over two fields in the
> noa1305_int_time_available array. Fix iteration limit, which
> has to be halved to avoid out of bounds access in case the
> value that is being looked up is not in the array.
>
> Fixes: 025f23cfebad ("iio: light: noa1305: Make integration time configurable")
> Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> Suggested-by: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
> Signed-off-by: Marek Vasut <marex@xxxxxxx>
Applied. Thanks,
> ---
> Cc: "Uwe Kleine-König" <u.kleine-koenig@xxxxxxxxxxxxxx>
> Cc: Jonathan Cameron <jic23@xxxxxxxxxx>
> Cc: Lars-Peter Clausen <lars@xxxxxxxxxx>
> Cc: linux-iio@xxxxxxxxxxxxxxx
> ---
> drivers/iio/light/noa1305.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iio/light/noa1305.c b/drivers/iio/light/noa1305.c
> index da83425fd9100..25f63da70297e 100644
> --- a/drivers/iio/light/noa1305.c
> +++ b/drivers/iio/light/noa1305.c
> @@ -197,7 +197,7 @@ static int noa1305_write_raw(struct iio_dev *indio_dev,
> return -EINVAL;
>
> /* Look up integration time register settings and write it if found. */
> - for (i = 0; i < ARRAY_SIZE(noa1305_int_time_available); i++)
> + for (i = 0; i < ARRAY_SIZE(noa1305_int_time_available) / 2; i++)
> if (noa1305_int_time_available[2 * i + 1] == val2)
> return regmap_write(priv->regmap, NOA1305_REG_INTEGRATION_TIME, i);
>
