Received-SPF: pass (google.com: domain of linux-kernel+bounces-14781-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Date: Tue, 2 Jan 2024 19:42:09 +0000
From: Jonathan Cameron <jic23@kernel.org>
To: zhouzhouyi@gmail.com
Cc: songqiang1304521@gmail.com, lars@metafoo.de, linux-iio@vger.kernel.org,
 linux-kernel@vger.kernel.org, "zhili.liu" <zhili.liu@ucas.com.cn>
Subject: Re: [PATCH v3] iio: magnetometer: rm3100: add boundary check for
 the value read from RM3100_REG_TMRC
Message-ID: <20240102194209.39dac963@jic23-huawei>
In-Reply-To: <1704157631-3814-1-git-send-email-zhouzhouyi@gmail.com>
References: <1704157631-3814-1-git-send-email-zhouzhouyi@gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Tue,  2 Jan 2024 09:07:11 +0800
zhouzhouyi@gmail.com wrote:

> From: "zhili.liu" <zhili.liu@ucas.com.cn>
> 
> Recently, we encounter kernel crash in function rm3100_common_probe
> caused by out of bound access of array rm3100_samp_rates (because of
> underlying hardware failures). Add boundary check to prevent out of
> bound access.
> 
> Fixes: 121354b2eceb ("iio: magnetometer: Add driver support for PNI RM3100")
Fixes is a formal tag so needs to be part of the main tags block
(i.e. No blank line here!)

I'll fix that whilst applying.

> 
> Suggested-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
> Signed-off-by: zhili.liu <zhili.liu@ucas.com.cn>
> ---
>  drivers/iio/magnetometer/rm3100-core.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/magnetometer/rm3100-core.c b/drivers/iio/magnetometer/rm3100-core.c
> index 69938204456f..12c2e3b0aeb6 100644
> --- a/drivers/iio/magnetometer/rm3100-core.c
> +++ b/drivers/iio/magnetometer/rm3100-core.c
> @@ -530,6 +530,7 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq)
>  	struct rm3100_data *data;
>  	unsigned int tmp;
>  	int ret;
> +	int samp_rate_index;
>  
>  	indio_dev = devm_iio_device_alloc(dev, sizeof(*data));
>  	if (!indio_dev)
> @@ -586,8 +587,14 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq)
>  	ret = regmap_read(regmap, RM3100_REG_TMRC, &tmp);
>  	if (ret < 0)
>  		return ret;
> +
> +	samp_rate_index = tmp - RM3100_TMRC_OFFSET;
> +	if (samp_rate_index < 0 || samp_rate_index >=  RM3100_SAMP_NUM) {
> +		dev_err(dev, "The value read from RM3100_REG_TMRC is invalid!\n");
> +		return -EINVAL;
> +	}
>  	/* Initializing max wait time, which is double conversion time. */
> -	data->conversion_time = rm3100_samp_rates[tmp - RM3100_TMRC_OFFSET][2]
> +	data->conversion_time = rm3100_samp_rates[samp_rate_index][2]
>  				* 2;
I've rewrapped this to be on one line whilst applying. Make sure to check for
side effects like this when updating code.  If we don't tidy it up at the time
we end up with gradually worse formatting over a long period!

Applied to the fixes-togreg branch of iio.git and marked for stable.

Thanks,

Jonathan

>  
>  	/* Cycle count values may not be what we want. */