github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-07 22:14:04 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

iio: inv_mpu6050: Fully validate gyro and accel scale writes

Browse Source 
commit e09fe91353 upstream.

When setting the gyro or accelerometer scale the inv_mpu6050 driver ignores
the integer part of the value. As a result e.g. all of 0.13309, 1.13309,
12345.13309, ... are accepted as a valid gyro scale and 0.13309 is the
scale that gets set in all those cases.

Make sure to check that the integer part of the scale value is 0 and reject
it otherwise.

Fixes: 09a642b785 ("Invensense MPU6050 Device Driver.")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jean-Baptiste Maneyrol <jmaneyrol@invensense.com>
Link: https://lore.kernel.org/r/20210405114441.24167-1-lars@metafoo.de
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Lars-Peter Clausen 2021-04-05 13:44:41 +02:00 committed by Greg Kroah-Hartman
parent a1ad124c83
commit 5670ed4d55
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
View File

@ -723,12 +723,16 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev,
} }
} }
static int inv_mpu6050_write_gyro_scale(struct inv_mpu6050_state *st, int val) static int inv_mpu6050_write_gyro_scale(struct inv_mpu6050_state *st, int val,
int val2)
{ {
int result, i; int result, i;
if (val != 0)
return -EINVAL;
for (i = 0; i < ARRAY_SIZE(gyro_scale_6050); ++i) { for (i = 0; i < ARRAY_SIZE(gyro_scale_6050); ++i) {
if (gyro_scale_6050[i] == val) { if (gyro_scale_6050[i] == val2) {
result = inv_mpu6050_set_gyro_fsr(st, i); result = inv_mpu6050_set_gyro_fsr(st, i);
if (result) if (result)
return result; return result;
@ -759,13 +763,17 @@ static int inv_write_raw_get_fmt(struct iio_dev *indio_dev,
return -EINVAL; return -EINVAL;
} }
static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val) static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val,
int val2)
{ {
int result, i; int result, i;
u8 d; u8 d;
if (val != 0)
return -EINVAL;
for (i = 0; i < ARRAY_SIZE(accel_scale); ++i) { for (i = 0; i < ARRAY_SIZE(accel_scale); ++i) {
if (accel_scale[i] == val) { if (accel_scale[i] == val2) {
d = (i << INV_MPU6050_ACCL_CONFIG_FSR_SHIFT); d = (i << INV_MPU6050_ACCL_CONFIG_FSR_SHIFT);
result = regmap_write(st->map, st->reg->accl_config, d); result = regmap_write(st->map, st->reg->accl_config, d);
if (result) if (result)
@ -806,10 +814,10 @@ static int inv_mpu6050_write_raw(struct iio_dev *indio_dev,
case IIO_CHAN_INFO_SCALE: case IIO_CHAN_INFO_SCALE:
switch (chan->type) { switch (chan->type) {
case IIO_ANGL_VEL: case IIO_ANGL_VEL:
result = inv_mpu6050_write_gyro_scale(st, val2); result = inv_mpu6050_write_gyro_scale(st, val, val2);
break; break;
case IIO_ACCEL: case IIO_ACCEL:
result = inv_mpu6050_write_accel_scale(st, val2); result = inv_mpu6050_write_accel_scale(st, val, val2);
break; break;
default: default:
result = -EINVAL; result = -EINVAL;