diff options
| author | Hui Su <sh_def@163.com> | 2026-08-11 10:52:53 +0800 |
|---|---|---|
| committer | Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> | 2026-08-15 22:56:54 +0100 |
| commit | 399561eb638666224d0221cb7d24e4fcaa85528a (patch) | |
| tree | a13bbfb114887a74d45ade6cdbf40cfefab8d013 /drivers/iio | |
| parent | fdcb9bf4aca17bf7681831bae38891f3f091c560 (diff) | |
| download | linux-next-399561eb638666224d0221cb7d24e4fcaa85528a.tar.gz linux-next-399561eb638666224d0221cb7d24e4fcaa85528a.zip | |
iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
The sampling frequency tables store each frequency as an integer part and
a fractional part in micro units. num_sampling_freq_avail is initialized
to the number of flattened integer elements because read_avail() returns
the table as a flat array.
bmp280_write_sampling_frequency(), however, indexes the same table as a
two-dimensional array and uses num_sampling_freq_avail as the number of
rows. Convert the flattened element count back to the number of rows
before iterating over the table.
Fixes: 10b40ffba2f9 ("iio: pressure: bmp280: Add more tunable config parameters for BMP380")
Cc: stable@vger.kernel.org
Signed-off-by: Hui Su <sh_def@163.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Diffstat (limited to 'drivers/iio')
| -rw-r--r-- | drivers/iio/pressure/bmp280-core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c index 990340a9b10c..dbe42233c81d 100644 --- a/drivers/iio/pressure/bmp280-core.c +++ b/drivers/iio/pressure/bmp280-core.c @@ -836,7 +836,7 @@ static int bmp280_write_sampling_frequency(struct bmp280_data *data, int val, int val2) { const int (*avail)[2] = data->chip_info->sampling_freq_avail; - const int n = data->chip_info->num_sampling_freq_avail; + const int n = data->chip_info->num_sampling_freq_avail / 2; int ret, prev; int i; |