Commit 2cc0b1a2 authored by Nicolas Pitre's avatar Nicolas Pitre Committed by Daniel Lezcano
Browse files

thermal/drivers/mediatek/lvts_thermal: Guard against efuse data buffer overflow 



We don't want to silently fetch garbage past the actual buffer.

Signed-off-by: default avatarNicolas Pitre <npitre@baylibre.com>
Signed-off-by: default avatarDaniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240402032729.2736685-6-nico@fluxnic.net
parent 5b3367e2

drivers/thermal/mediatek/lvts_thermal.c

+9 −2
Original line number Diff line number Diff line
@@ -672,7 +672,8 @@ static int lvts_sensor_init(struct device *dev, struct lvts_ctrl *lvts_ctrl, 
 */

static int lvts_calibration_init(struct device *dev, struct lvts_ctrl *lvts_ctrl,

					const struct lvts_ctrl_data *lvts_ctrl_data,

					u8 *efuse_calibration)

					u8 *efuse_calibration,

					size_t calib_len)

{

	int i;
@@ -680,6 +681,11 @@ static int lvts_calibration_init(struct device *dev, struct lvts_ctrl *lvts_ctrl 
		const struct lvts_sensor_data *sensor =

					&lvts_ctrl_data->lvts_sensor[i];



		if (sensor->cal_offsets[0] >= calib_len ||

		    sensor->cal_offsets[1] >= calib_len ||

		    sensor->cal_offsets[2] >= calib_len)

			return -EINVAL;



		lvts_ctrl->calibration[i] =

			(efuse_calibration[sensor->cal_offsets[0]] << 0) +

			(efuse_calibration[sensor->cal_offsets[1]] << 8) +
@@ -791,7 +797,8 @@ static int lvts_ctrl_init(struct device *dev, struct lvts_domain *lvts_td, 


		ret = lvts_calibration_init(dev, &lvts_ctrl[i],

					    &lvts_data->lvts_ctrl[i],

					    lvts_td->calib);

					    lvts_td->calib,

					    lvts_td->calib_len);

		if (ret)

			return ret;