patch "iio:health:afe4403 Fix timestamp alignment and prevent data leak." added to staging-linus
Subsystems (2)
This is a note to let you know that I've just added the patch titled
iio:health:afe4403 Fix timestamp alignment and prevent data leak.
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.
If you have any questions about this process, please let me know.
From 3f9c6d38797e9903937b007a341dad0c251765d6 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <[email protected]>
Date: Sun, 17 May 2020 18:29:56 +0100
Subject: iio:health:afe4403 Fix timestamp alignment and prevent data leak.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses a 32 byte array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv() data with alignment explicitly requested. This data is allocated with kzalloc so no data can leak appart from previous readings.
--- drivers/iio/health/afe4403.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/iio/health/afe4403.c +6 -3
@@ -65,6 +65,7 @@ static const struct reg_field afe4403_reg_fields[] = {* @regulator: Pointer to the regulator for the IC * @trig: IIO trigger for this device * @irq: ADC_RDY line interrupt number +* @buffer: Used to construct data layout to push into IIO buffer. */ struct afe4403_data {struct device *dev;
@@ -74,6 +75,8 @@ struct afe4403_data {struct regulator *regulator;struct iio_trigger *trig;int irq; +/* Ensure suitable alignment for timestamp */ +s32 buffer[8 ]__aligned(8) ; };enum afe4403_chan_id {
@@ -309,7 +312,6 @@ static irqreturn_t afe4403_trigger_handler(int irq, void *private)struct iio_dev *indio_dev = pf->indio_dev;struct afe4403_data *afe =iio_priv (indio_dev);int ret, bit, i =0 ; -s32 buffer[8 ];u8 tx[4 ] = {AFE440X_CONTROL0 ,0x0 ,0x0 ,AFE440X_CONTROL0_READ };u8 rx[3 ];
@@ -326,7 +328,7 @@ static irqreturn_t afe4403_trigger_handler(int irq, void *private)if (ret) goto err; - buffer[i++] =get_unaligned_be24 (&rx[0 ]); + afe->buffer[i++] =get_unaligned_be24 (&rx[0 ]); }/* Disable reading from the device */
@@ -335,7 +337,8 @@ static irqreturn_t afe4403_trigger_handler(int irq, void *private)if (ret) goto err; -iio_push_to_buffers_with_timestamp (indio_dev, buffer, pf->timestamp); +iio_push_to_buffers_with_timestamp (indio_dev, afe->buffer, + pf->timestamp); err:iio_trigger_notify_done (indio_dev->trig);
Signature · 1 line
2.27.0