From: Alexandre Belloni Date: Mon, 13 Jan 2014 16:02:00 +0000 (+0000) Subject: iio: mxs-lradc: fix buffer overflow X-Git-Tag: v3.14-rc3~12^2~1^2~6 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=d4bf105bb65b61fd9036031a1854383381ef638f;p=profile%2Fivi%2Fkernel-x86-ivi.git iio: mxs-lradc: fix buffer overflow Fixes: drivers/staging/iio/adc/mxs-lradc.c:1556 mxs_lradc_probe() error: buffer overflow 'iio->channels' 15 <= 15 The reported available scales for in_voltage15 were also wrong. The realbits lookup is not necessary as all the channels of the LRADC have the same resolution, use LRADC_RESOLUTION instead. Reported-by: Dan Carpenter Signed-off-by: Alexandre Belloni Signed-off-by: Jonathan Cameron --- diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c index df71669..aa86849 100644 --- a/drivers/staging/iio/adc/mxs-lradc.c +++ b/drivers/staging/iio/adc/mxs-lradc.c @@ -1613,7 +1613,7 @@ static int mxs_lradc_probe(struct platform_device *pdev) * of the array. */ scale_uv = ((u64)lradc->vref_mv[i] * 100000000) >> - (iio->channels[i].scan_type.realbits - s); + (LRADC_RESOLUTION - s); lradc->scale_avail[i][s].nano = do_div(scale_uv, 100000000) * 10; lradc->scale_avail[i][s].integer = scale_uv;