[Xenial][SRU][PATCH 2/2] iio: dac: ad5592r: Off by one bug in ad5592r_alloc_channels()

Shrirang Bagul shrirang.bagul at canonical.com
Fri Nov 25 11:11:58 UTC 2016


From: Dan Carpenter <dan.carpenter at oracle.com>

BugLink: https://launchpad.net/bugs/1644726

The > here should be >= or we go beyond the end for the array.

Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
Signed-off-by: Jonathan Cameron <jic23 at kernel.org>
(backported from commit 04bf02175fe9577875fb8285cc2d08169fef613a)
Signed-off-by: Shrirang Bagul <shrirang.bagul at canonical.com>
---
 drivers/iio/dac/ad5592r-base.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/dac/ad5592r-base.c b/drivers/iio/dac/ad5592r-base.c
index 3d12d9e..14412f3 100644
--- a/drivers/iio/dac/ad5592r-base.c
+++ b/drivers/iio/dac/ad5592r-base.c
@@ -530,7 +530,7 @@ static int ad5592r_alloc_channels(struct ad5592r_state *st)
 
 	device_for_each_child_node(st->dev, child) {
 		ret = fwnode_property_read_u32(child, "reg", &reg);
-		if (ret || reg > ARRAY_SIZE(st->channel_modes))
+		if (ret || reg >= ARRAY_SIZE(st->channel_modes))
 			continue;
 
 		ret = fwnode_property_read_u32(child, "adi,mode", &tmp);
-- 
2.9.3





More information about the kernel-team mailing list