On Sun, Jun 07, 2020 at 04:53:54PM +0100, Jonathan Cameron wrote:
> From: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
>
> One of a class of bugs pointed out by Lars in a recent review.
> iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
> to the size of the timestamp (8 bytes). This is not guaranteed in
> this driver which uses an array of smaller elements on the stack.
> As Lars also noted this anti pattern can involve a leak of data to
> userspace and that indeed can happen here. We close both issues by
> moving to a suitable array in the iio_priv() data with alignment
> explicitly requested. This data is allocated with kzalloc so no
> data can leak apart from previous readings.
> + /* Ensure natural alignment for timestamp if present */
> + __le16 buf[16] __aligned(8);
Perhaps struct in all such cases, like
struct scan {
__le16 buf[3 * 3]; // 3 axis per 3 sensors
s64 ts; __aligned(8);
};
?
--
With Best Regards,
Andy Shevchenko
