linux-kernel - [PATCH 1/1] drivers/iio/magnetometer/rm3100-core.c:add boundary check for the value read from RM3100_REG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 31 Dec 2023 21:28:17 +0800
From: "zhili.liu" <zhili.liu@...s.com.cn>
To: songqiang1304521@...il.com, jic23@...nel.org, lars@...afoo.de
Cc: linux-iio@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH 1/1] drivers/iio/magnetometer/rm3100-core.c:add boundary
 check for the value read from RM3100_REG_TMRC

>From d985bd979df3f1c4327e1374f1af953a1024de33 Mon Sep 17 00:00:00 2001
From: "zhili.liu" <zhili.liu@...s.com.cn>
Date: Fri, 29 Dec 2023 19:52:40 +0800
Subject: [PATCH] iio: magnetometer: rm3100: add boundary check for the value
 read from RM3100_REG_TMRC

Recently, we encounter kernel crash in function rm3100_common_probe
caused by out of bound access of array rm3100_samp_rates (because of
underlying hardware failures). Add boundary check to prevent out of
bound access.

Suggested-by: Zhouyi Zhou <zhouzhouyi@...il.com>
Signed-off-by: zhili.liu <zhili.liu@...s.com.cn>
---
 drivers/iio/magnetometer/rm3100-core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/iio/magnetometer/rm3100-core.c b/drivers/iio/magnetometer/rm3100-core.c
index 69938204456f..fc50b6d4a334 100644
--- a/drivers/iio/magnetometer/rm3100-core.c
+++ b/drivers/iio/magnetometer/rm3100-core.c
@@ -586,6 +586,12 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq)
 	ret = regmap_read(regmap, RM3100_REG_TMRC, &tmp);
 	if (ret < 0)
 		return ret;
+
+	if (tmp < RM3100_SAMP_NUM || tmp - RM3100_TMRC_OFFSET >= RM3100_SAMP_NUM) {
+		dev_err(dev, "The value read from RM3100_REG_TMRC is invalid!\n");
+		return -EINVAL;
+	}
+
 	/* Initializing max wait time, which is double conversion time. */
 	data->conversion_time = rm3100_samp_rates[tmp - RM3100_TMRC_OFFSET][2]
 				* 2;
-- 
2.25.1