iio:core: Fix bug in length of event info_mask and catch unhandled bits set in masks.
authorYoung Xiao <92siuyang@gmail.com>
Tue, 4 Jun 2019 12:40:00 +0000 (20:40 +0800)
committerJonathan Cameron <Jonathan.Cameron@huawei.com>
Mon, 17 Jun 2019 20:06:44 +0000 (21:06 +0100)
The incorrect limit for the for_each_set_bit loop was noticed whilst fixing
this other case.  Note that as we only have 3 possible entries a the moment
and the value was set to 4, the bug would not have any effect currently.
It will bite fairly soon though, so best fix it now.

See commit ef4b4856593f ("iio:core: Fix bug in length of event info_mask and
catch unhandled bits set in masks.") for details.

Signed-off-by: Young Xiao <92siuyang@gmail.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
drivers/iio/industrialio-core.c

index f5a4581302f48413738c11805d7adb41cd44df60..dd8873a752dd469ae82395d62e92b337320be03f 100644 (file)
@@ -1107,6 +1107,8 @@ static int iio_device_add_info_mask_type_avail(struct iio_dev *indio_dev,
        char *avail_postfix;
 
        for_each_set_bit(i, infomask, sizeof(*infomask) * 8) {
+               if (i >= ARRAY_SIZE(iio_chan_info_postfix))
+                       return -EINVAL;
                avail_postfix = kasprintf(GFP_KERNEL,
                                          "%s_available",
                                          iio_chan_info_postfix[i]);