iio: ssp_sensors: add more range checking in ssp_parse_dataframe()

commit 8167c9a375ccceed19048ad9d68cb2d02ed276e0 upstream.

The "idx" is validated at the start of the loop but it gets incremented
during the iteration so it needs to be checked again.

Fixes: 2d08e61eaf01 ("iio: common: ssp_sensors: Add sensorhub driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20210909091336.GA26312@kili
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/iio/common/ssp_sensors/ssp_spi.c b/drivers/iio/common/ssp_sensors/ssp_spi.c
index 7db3d5886e3ee537d3e34e58c06a2df87b7dad7d..7d886642af6d84d36b3fcd19a8ad40ee0dd7a2ff 100644 (file)
--- a/drivers/iio/common/ssp_sensors/ssp_spi.c
+++ b/drivers/iio/common/ssp_sensors/ssp_spi.c
@@ -273,6 +273,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len)
        for (idx = 0; idx < len;) {
                switch (dataframe[idx++]) {
                case SSP_MSG2AP_INST_BYPASS_DATA:
+                       if (idx >= len)
+                               return -EPROTO;
                        sd = dataframe[idx++];
                        if (sd < 0 || sd >= SSP_SENSOR_MAX) {
                                dev_err(SSP_DEV,
@@ -282,10 +284,13 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len)
 
                        if (indio_devs[sd]) {
                                spd = iio_priv(indio_devs[sd]);
-                               if (spd->process_data)
+                               if (spd->process_data) {
+                                       if (idx >= len)
+                                               return -EPROTO;
                                        spd->process_data(indio_devs[sd],
                                                          &dataframe[idx],
                                                          data->timestamp);
+                               }
                        } else {
                                dev_err(SSP_DEV, "no client for frame\n");
                        }
@@ -293,6 +298,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len)
                        idx += ssp_offset_map[sd];
                        break;
                case SSP_MSG2AP_INST_DEBUG_DATA:
+                       if (idx >= len)
+                               return -EPROTO;
                        sd = ssp_print_mcu_debug(dataframe, &idx, len);
                        if (sd) {
                                dev_err(SSP_DEV,