linux-kernel - [PATCH] iio: adc: MCP3564: fix calib_bias and calib

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20231201-mcp3564_range_checks-v1-1-68f4436e22b0@gmail.com>
Date:   Fri, 01 Dec 2023 10:48:03 +0100
From:   Javier Carrasco <javier.carrasco.cruz@...il.com>
To:     Marius Cristea <marius.cristea@...rochip.com>,
        Jonathan Cameron <jic23@...nel.org>,
        Lars-Peter Clausen <lars@...afoo.de>
Cc:     linux-iio@...r.kernel.org, linux-kernel@...r.kernel.org,
        Javier Carrasco <javier.carrasco.cruz@...il.com>
Subject: [PATCH] iio: adc: MCP3564: fix calib_bias and calib_scale range
 checks

The current implementation uses the AND (&&) operator to check if the
value to write for IIO_CHAN_INFO_CALIBBIAS and IIO_CHAN_INFO_CALIBSCALE
is within the valid ranges.
The evaluated values are the lower and upper limits of the ranges,
so this operation always evaluates to false.

The OR (||) operator must be used instead.

Signed-off-by: Javier Carrasco <javier.carrasco.cruz@...il.com>
---
This bug has been found when looking for use cases of IIO_AVAIL_RANGE
and the fix could not be tested with real hardware. The issue and its
soulution are rather simple, but still some testing and confirmation
would be welcome.
---
 drivers/iio/adc/mcp3564.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/adc/mcp3564.c b/drivers/iio/adc/mcp3564.c
index e3f1de5fcc5a..d5fb1cae8aeb 100644
--- a/drivers/iio/adc/mcp3564.c
+++ b/drivers/iio/adc/mcp3564.c
@@ -918,7 +918,7 @@ static int mcp3564_write_raw(struct iio_dev *indio_dev,
 		mutex_unlock(&adc->lock);
 		return ret;
 	case IIO_CHAN_INFO_CALIBBIAS:
-		if (val < mcp3564_calib_bias[0] && val > mcp3564_calib_bias[2])
+		if (val < mcp3564_calib_bias[0] || val > mcp3564_calib_bias[2])
 			return -EINVAL;
 
 		mutex_lock(&adc->lock);
@@ -928,7 +928,7 @@ static int mcp3564_write_raw(struct iio_dev *indio_dev,
 		mutex_unlock(&adc->lock);
 		return ret;
 	case IIO_CHAN_INFO_CALIBSCALE:
-		if (val < mcp3564_calib_scale[0] && val > mcp3564_calib_scale[2])
+		if (val < mcp3564_calib_scale[0] || val > mcp3564_calib_scale[2])
 			return -EINVAL;
 
 		if (adc->calib_scale == val)

---
base-commit: 994d5c58e50e91bb02c7be4a91d5186292a895c8
change-id: 20231201-mcp3564_range_checks-221708838130

Best regards,
-- 
Javier Carrasco <javier.carrasco.cruz@...il.com>