From: Denis Rastyogin <gerben@altlinux.org>
The bmi323_channels[] array defines a channel with chan->type =
IIO_TEMP and enables the IIO_CHAN_INFO_SCALE mask. As a result,
bmi323_write_raw() may be called for this channel. However,
bmi323_iio_to_sensor() returns -EINVAL for IIO_TEMP, and if this
value is not validated, it can lead to an out-of-bounds access
when used as an array index.
A similar case is properly handled in bmi323_read_raw() and does
not result in an error.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 8a636db3aa57 ("iio: imu: Add driver for BMI323 IMU")
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
---
drivers/iio/imu/bmi323/bmi323_core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/imu/bmi323/bmi323_core.c b/drivers/iio/imu/bmi323/bmi323_core.c
index 6bcb9a436581..64ead4f667e0 100644
--- a/drivers/iio/imu/bmi323/bmi323_core.c
+++ b/drivers/iio/imu/bmi323/bmi323_core.c
@@ -1713,6 +1713,8 @@ static int bmi323_write_raw(struct iio_dev *indio_dev,
iio_device_release_direct(indio_dev);
return ret;
case IIO_CHAN_INFO_SCALE:
+ if (chan->type == IIO_TEMP)
+ return -EINVAL;
if (!iio_device_claim_direct(indio_dev))
return -EBUSY;
ret = bmi323_set_scale(data, bmi323_iio_to_sensor(chan->type),
--
2.42.2