iio: adc: at91-sama5d2_adc: fix channel configuration for differential channels

[ Upstream commit f0c8d1f6dc8eac5a1fbf441c8e080721a7b6c0ff ]

When iterating through the channels, the index in the array is not the
scan index. Added an xlate function to translate to the proper index.
The result of the bug is that the channel array is indexed with a wrong index,
thus instead of the proper channel, we access invalid memory, which may
lead to invalid results and/or corruption.
This will be used also for devicetree channel xlate.

Fixes: 5e1a1da0f ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support")
Fixes: 073c66201 ("iio: adc: at91-sama5d2_adc: add support for DMA")
Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
index a70ef7fec95f05065295a41280d7b17632aac7c9..0898f40c2b8929ac2a4b81bda5f192cffc43e8ba 100644 (file)
--- a/drivers/iio/adc/at91-sama5d2_adc.c
+++ b/drivers/iio/adc/at91-sama5d2_adc.c
@@ -300,6 +300,27 @@ static const struct iio_chan_spec at91_adc_channels[] = {
                                + AT91_SAMA5D2_DIFF_CHAN_CNT + 1),
 };
 
+static int at91_adc_chan_xlate(struct iio_dev *indio_dev, int chan)
+{
+       int i;
+
+       for (i = 0; i < indio_dev->num_channels; i++) {
+               if (indio_dev->channels[i].scan_index == chan)
+                       return i;
+       }
+       return -EINVAL;
+}
+
+static inline struct iio_chan_spec const *
+at91_adc_chan_get(struct iio_dev *indio_dev, int chan)
+{
+       int index = at91_adc_chan_xlate(indio_dev, chan);
+
+       if (index < 0)
+               return NULL;
+       return indio_dev->channels + index;
+}
+
 static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
 {
        struct iio_dev *indio = iio_trigger_get_drvdata(trig);
@@ -317,8 +338,10 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
        at91_adc_writel(st, AT91_SAMA5D2_TRGR, status);
 
        for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) {
-               struct iio_chan_spec const *chan = indio->channels + bit;
+               struct iio_chan_spec const *chan = at91_adc_chan_get(indio, bit);
 
+               if (!chan)
+                       continue;
                if (state) {
                        at91_adc_writel(st, AT91_SAMA5D2_CHER,
                                        BIT(chan->channel));
@@ -398,8 +421,11 @@ static irqreturn_t at91_adc_trigger_handler(int irq, void *p)
        u8 bit;
 
        for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) {
-               struct iio_chan_spec const *chan = indio->channels + bit;
+               struct iio_chan_spec const *chan =
+                                       at91_adc_chan_get(indio, bit);
 
+               if (!chan)
+                       continue;
                st->buffer[i] = at91_adc_readl(st, chan->address);
                i++;
        }