iio: adc: nxp-sar-adc: fix division by zero in write_raw

Add a validation check for the sampling frequency value before using it
as a divisor. A user writing zero or a negative value to the
sampling_frequency sysfs attribute triggers a division by zero in the
kernel.

Also prevent unsigned integer underflow when the computed cycle count is
smaller than NXP_SAR_ADC_CONV_TIME, which would wrap the u32 inpsamp to
a huge value.

Fixes: 4434072a893e ("iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms")
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>

diff --git a/drivers/iio/adc/nxp-sar-adc.c b/drivers/iio/adc/nxp-sar-adc.c
index 705dd7da1bd22e1437b3c7e3104e2444a95ce408..1711cae7d872a10bb612e74551dc21bbca5eb2ff 100644 (file)
--- a/drivers/iio/adc/nxp-sar-adc.c
+++ b/drivers/iio/adc/nxp-sar-adc.c
@@ -569,6 +569,9 @@ static int nxp_sar_adc_write_raw(struct iio_dev *indio_dev, struct iio_chan_spec
 
        switch (mask) {
        case IIO_CHAN_INFO_SAMP_FREQ:
+               if (val <= 0)
+                       return -EINVAL;
+
                /*
                 * Configures the sample period duration in terms of the SAR
                 * controller clock. The minimum acceptable value is 8.
@@ -577,7 +580,11 @@ static int nxp_sar_adc_write_raw(struct iio_dev *indio_dev, struct iio_chan_spec
                 * sampling timing which gives us the number of cycles expected.
                 * The value is 8-bit wide, consequently the max value is 0xFF.
                 */
-               inpsamp = clk_get_rate(info->clk) / val - NXP_SAR_ADC_CONV_TIME;
+               inpsamp = clk_get_rate(info->clk) / val;
+               if (inpsamp < NXP_SAR_ADC_CONV_TIME)
+                       return -EINVAL;
+
+               inpsamp -= NXP_SAR_ADC_CONV_TIME;
                nxp_sar_adc_conversion_timing_set(info, inpsamp);
                return 0;