From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752993AbcFBKGl (ORCPT ); Thu, 2 Jun 2016 06:06:41 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:36309 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751189AbcFBKGj (ORCPT ); Thu, 2 Jun 2016 06:06:39 -0400 From: Colin King To: Lars-Peter Clausen , Michael Hennerich , Jonathan Cameron , Hartmut Knaack , Peter Meerwald-Stadler , linux-iio@vger.kernel.org Cc: linux-kernel@vger.kernel.org Subject: [PATCH] iio: dac: fix off-by-one comparison and out-of-bounds write Date: Thu, 2 Jun 2016 11:06:30 +0100 Message-Id: <1464861990-9155-1-git-send-email-colin.king@canonical.com> X-Mailer: git-send-email 2.8.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Colin Ian King The check on reg is off-by-one, it should be >= rather than >. Fix this to stop an out-of-bounds write to st->channel_modes[reg]. Signed-off-by: Colin Ian King --- drivers/iio/dac/ad5592r-base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/dac/ad5592r-base.c b/drivers/iio/dac/ad5592r-base.c index 948f600..69bde59 100644 --- a/drivers/iio/dac/ad5592r-base.c +++ b/drivers/iio/dac/ad5592r-base.c @@ -525,7 +525,7 @@ static int ad5592r_alloc_channels(struct ad5592r_state *st) device_for_each_child_node(st->dev, child) { ret = fwnode_property_read_u32(child, "reg", ®); - if (ret || reg > ARRAY_SIZE(st->channel_modes)) + if (ret || reg >= ARRAY_SIZE(st->channel_modes)) continue; ret = fwnode_property_read_u32(child, "adi,mode", &tmp); -- 2.8.1