On Sun, May 17, 2020 at 06:29:59PM +0100, jic23@xxxxxxxxxx wrote:
> From: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
>
> One of a class of bugs pointed out by Lars in a recent review.
> iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
> to the size of the timestamp (8 bytes). This is not guaranteed in
> this driver which uses an array of smaller elements on the stack.
>
> Fixes: 232e0f6ddeae ("iio: chemical: add support for Sensirion SPS30 sensor")
> Reported-by: Lars-Peter Clausen <lars@xxxxxxxxxx>
> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
> Cc: Tomasz Duszynski <tduszyns@xxxxxxxxx>
> ---
> drivers/iio/chemical/sps30.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/iio/chemical/sps30.c b/drivers/iio/chemical/sps30.c
> index acb9f8ecbb3d..a88c1fb875a0 100644
> --- a/drivers/iio/chemical/sps30.c
> +++ b/drivers/iio/chemical/sps30.c
> @@ -230,15 +230,18 @@ static irqreturn_t sps30_trigger_handler(int irq, void *p)
> struct iio_dev *indio_dev = pf->indio_dev;
> struct sps30_state *state = iio_priv(indio_dev);
> int ret;
> - s32 data[4 + 2]; /* PM1, PM2P5, PM4, PM10, timestamp */
> + struct {
> + s32 data[4]; /* PM1, PM2P5, PM4, PM10 */
> + s64 ts;
> + } scan;
>
> mutex_lock(&state->lock);
> - ret = sps30_do_meas(state, data, 4);
> + ret = sps30_do_meas(state, scan.data, ARRAY_SIZE(scan.data));
> mutex_unlock(&state->lock);
> if (ret)
> goto err;
>
> - iio_push_to_buffers_with_timestamp(indio_dev, data,
> + iio_push_to_buffers_with_timestamp(indio_dev, &scan,
> iio_get_time_ns(indio_dev));
> err:
> iio_trigger_notify_done(indio_dev->trig);
> --
> 2.26.2
>
Thanks for the fix.
Acked-by: Tomasz Duszynski <tomasz.duszynski@xxxxxxxxxxx>
