OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

staging:iio:light: V3 fix out of bounds reg_cache[] access 

V3 is a straightforward forward port to teh current tree of V2.

Simple fix is to just not cache REG_TEST (offset 8).
Cache doesn't help REG_TEST anyway since we write all 8 bits exactly once
(at resume/init time).

Also fix an "off-by-one" allocation of reg_cache[] array size that
was in the original code before I touched it.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Jonathan Cameron 2011-09-09 09:53:05 +01:00 committed by Greg Kroah-Hartman
parent 66e60413db
commit 25d7315a19
1 changed files with 14 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
drivers/staging/iio/light/isl29018.c
View File

@ -51,7 +51,7 @@
#define ISL29018_REG_ADD_DATA_LSB 0x02
#define ISL29018_REG_ADD_DATA_MSB 0x03
#define ISL29018_MAX_REGS ISL29018_REG_ADD_DATA_MSB
#define ISL29018_MAX_REGS (ISL29018_REG_ADD_DATA_MSB+1)
#define ISL29018_REG_TEST 0x08
#define ISL29018_TEST_SHIFT 0
@ -70,22 +70,27 @@ struct isl29018_chip {
static int isl29018_write_data(struct i2c_client *client, u8 reg,
u8 val, u8 mask, u8 shift)
{
u8 regval;
int ret = 0;
u8 regval = val;
int ret;
struct isl29018_chip *chip = iio_priv(i2c_get_clientdata(client));
regval = chip->reg_cache[reg];
regval &= ~mask;
regval |= val << shift;
/* don't cache or mask REG_TEST */
if (reg < ISL29018_MAX_REGS) {
regval = chip->reg_cache[reg];
regval &= ~mask;
regval |= val << shift;
}
ret = i2c_smbus_write_byte_data(client, reg, regval);
if (ret) {
dev_err(&client->dev, "Write to device fails status %x\n", ret);
return ret;
} else {
/* don't update cache on err */
if (reg < ISL29018_MAX_REGS)
chip->reg_cache[reg] = regval;
}
chip->reg_cache[reg] = regval;
return 0;
return ret;
}
static int isl29018_set_range(struct i2c_client *client, unsigned long range,