diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-04-07 12:29:35 +0300 |
|---|---|---|
| committer | Enric Balletbo i Serra <enric.balletbo@collabora.com> | 2020-04-13 08:09:27 +0200 |
| commit | 5b69c23799ecfc279897e77f43625cc876d92765 (patch) | |
| tree | fa4837bbb27dfb912aa1f0bfeb1849b5dc4a9564 | |
| parent | a46387712da12b61bf1ce1a3f63b60a17b098960 (diff) | |
| download | linux-at91-5b69c23799ecfc279897e77f43625cc876d92765.tar.gz | |
platform/chrome: cros_ec_sensorhub: Off by one in cros_sensorhub_send_sample()
The sensorhub->push_data[] array has sensorhub->sensor_num elements.
It's allocated in cros_ec_sensorhub_ring_add(). So the > should be >=
to prevent a read one element beyond the end of the array.
Fixes: 145d59baff59 ("platform/chrome: cros_ec_sensorhub: Add FIFO support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
| -rw-r--r-- | drivers/platform/chrome/cros_ec_sensorhub_ring.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c index 230e6cf3da2f71..85e8ba782f0c68 100644 --- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c +++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c @@ -40,7 +40,7 @@ cros_sensorhub_send_sample(struct cros_ec_sensorhub *sensorhub, int id = sample->sensor_id; struct iio_dev *indio_dev; - if (id > sensorhub->sensor_num) + if (id >= sensorhub->sensor_num) return -EINVAL; cb = sensorhub->push_data[id].push_data_cb; |