[lvc-project] [PATCH] iio: imu: bmi323: Fix potential out-of-bounds access of bmi323_hw[]

[Fedor Pchelkin]

On Fri, 27. Mar 13:32, gerben at altlinux.org wrote:
> From: Denis Rastyogin <gerben at altlinux.org>
> 
> The bmi323_channels[] array defines a channel with chan->type =
> IIO_TEMP and enables the IIO_CHAN_INFO_SCALE mask. As a result,
> bmi323_write_raw() may be called for this channel. However,
> bmi323_iio_to_sensor() returns -EINVAL for IIO_TEMP, and if this
> value is not validated, it can lead to an out-of-bounds access
> when used as an array index.
> 
> A similar case is properly handled in bmi323_read_raw() and does
> not result in an error.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 8a636db3aa57 ("iio: imu: Add driver for BMI323 IMU")
> Signed-off-by: Denis Rastyogin <gerben at altlinux.org>
> ---

По возможности просьба довести исправление проблемы до апстрима, учтя
комментарии мэйнтейнеров.  Спасибо!