On Sun, 17 May 2020 21:07:28 +0200
Tomasz Duszynski <tomasz.duszynski@xxxxxxxxxxx> wrote:
> On Sun, May 17, 2020 at 06:29:59PM +0100, jic23@xxxxxxxxxx wrote:
> > From: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
> >
> > One of a class of bugs pointed out by Lars in a recent review.
> > iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
> > to the size of the timestamp (8 bytes). This is not guaranteed in
> > this driver which uses an array of smaller elements on the stack.
> >
> > Fixes: 232e0f6ddeae ("iio: chemical: add support for Sensirion SPS30 sensor")
> > Reported-by: Lars-Peter Clausen <lars@xxxxxxxxxx>
> > Signed-off-by: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
> > Cc: Tomasz Duszynski <tduszyns@xxxxxxxxx>
> > ---
> > drivers/iio/chemical/sps30.c | 9 ++++++---
> > 1 file changed, 6 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/iio/chemical/sps30.c b/drivers/iio/chemical/sps30.c
> > index acb9f8ecbb3d..a88c1fb875a0 100644
> > --- a/drivers/iio/chemical/sps30.c
> > +++ b/drivers/iio/chemical/sps30.c
> > @@ -230,15 +230,18 @@ static irqreturn_t sps30_trigger_handler(int irq, void *p)
> > struct iio_dev *indio_dev = pf->indio_dev;
> > struct sps30_state *state = iio_priv(indio_dev);
> > int ret;
> > - s32 data[4 + 2]; /* PM1, PM2P5, PM4, PM10, timestamp */
> > + struct {
> > + s32 data[4]; /* PM1, PM2P5, PM4, PM10 */
> > + s64 ts;
> > + } scan;
> >
> > mutex_lock(&state->lock);
> > - ret = sps30_do_meas(state, data, 4);
> > + ret = sps30_do_meas(state, scan.data, ARRAY_SIZE(scan.data));
> > mutex_unlock(&state->lock);
> > if (ret)
> > goto err;
> >
> > - iio_push_to_buffers_with_timestamp(indio_dev, data,
> > + iio_push_to_buffers_with_timestamp(indio_dev, &scan,
> > iio_get_time_ns(indio_dev));
> > err:
> > iio_trigger_notify_done(indio_dev->trig);
> > --
> > 2.26.2
> >
>
> Thanks for the fix.
> Acked-by: Tomasz Duszynski <tomasz.duszynski@xxxxxxxxxxx>
Applied to the fixes-togreg branch of iio.git.
I'm going to pick these up as and when I get reviews for them rather than
waiting for the whole series to have suitable reviews.
They are a small part of all the instances we have of this issue
so no point in waiting.
Thanks,
Jonathan
