summaryrefslogtreecommitdiff
path: root/drivers/platform/chrome/cros_ec_sensorhub_ring.c
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2020-04-07 12:29:35 +0300
committerEnric Balletbo i Serra <enric.balletbo@collabora.com>2020-04-13 09:09:27 +0300
commit5b69c23799ecfc279897e77f43625cc876d92765 (patch)
treefa4837bbb27dfb912aa1f0bfeb1849b5dc4a9564 /drivers/platform/chrome/cros_ec_sensorhub_ring.c
parenta46387712da12b61bf1ce1a3f63b60a17b098960 (diff)
downloadlinux-5b69c23799ecfc279897e77f43625cc876d92765.tar.xz
platform/chrome: cros_ec_sensorhub: Off by one in cros_sensorhub_send_sample()
The sensorhub->push_data[] array has sensorhub->sensor_num elements. It's allocated in cros_ec_sensorhub_ring_add(). So the > should be >= to prevent a read one element beyond the end of the array. Fixes: 145d59baff59 ("platform/chrome: cros_ec_sensorhub: Add FIFO support") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Guenter Roeck <groeck@chromium.org> Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Diffstat (limited to 'drivers/platform/chrome/cros_ec_sensorhub_ring.c')
-rw-r--r--drivers/platform/chrome/cros_ec_sensorhub_ring.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
index 230e6cf3da2f..85e8ba782f0c 100644
--- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c
+++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
@@ -40,7 +40,7 @@ cros_sensorhub_send_sample(struct cros_ec_sensorhub *sensorhub,
int id = sample->sensor_id;
struct iio_dev *indio_dev;
- if (id > sensorhub->sensor_num)
+ if (id >= sensorhub->sensor_num)
return -EINVAL;
cb = sensorhub->push_data[id].push_data_cb;