On Sun, 7 Jun 2020 16:53:47 +0100
Jonathan Cameron <jic23@xxxxxxxxxx> wrote:
> From: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
>
> One of a class of bugs pointed out by Lars in a recent review.
> iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
> to the size of the timestamp (8 bytes). This is not guaranteed in
> this driver which uses an array of smaller elements on the stack.
> As Lars also noted this anti pattern can involve a leak of data to
> userspace and that indeed can happen here. We close both issues by
> moving to a suitable structure in the iio_priv()
>
> This data is allocated with kzalloc so no data can leak apart
> from previous readings.
>
> Fixes: 3025c8688c1e ("iio: light: add support for UVIS25 sensor")
> Reported-by: Lars-Peter Clausen <lars@xxxxxxxxxx>
> Acked-by: Lorenzo Bianconi <lorenzo@xxxxxxxxxx>
> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
Applied to the fixes-togreg branch of iio.git and marked for stable.
I'm going to pick up all the ones in this series that I have had
an Ack for.
Thanks,
Jonathan
> ---
> drivers/iio/light/st_uvis25.h | 5 +++++
> drivers/iio/light/st_uvis25_core.c | 6 +++---
> 2 files changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/iio/light/st_uvis25.h b/drivers/iio/light/st_uvis25.h
> index 78bc56aad129..283086887caf 100644
> --- a/drivers/iio/light/st_uvis25.h
> +++ b/drivers/iio/light/st_uvis25.h
> @@ -27,6 +27,11 @@ struct st_uvis25_hw {
> struct iio_trigger *trig;
> bool enabled;
> int irq;
> + /* Ensure timestamp is naturally aligned */
> + struct {
> + u8 chan;
> + s64 ts __aligned(8);
> + } scan;
> };
>
> extern const struct dev_pm_ops st_uvis25_pm_ops;
> diff --git a/drivers/iio/light/st_uvis25_core.c b/drivers/iio/light/st_uvis25_core.c
> index 4d001d50e775..818b8faea73c 100644
> --- a/drivers/iio/light/st_uvis25_core.c
> +++ b/drivers/iio/light/st_uvis25_core.c
> @@ -234,17 +234,17 @@ static const struct iio_buffer_setup_ops st_uvis25_buffer_ops = {
>
> static irqreturn_t st_uvis25_buffer_handler_thread(int irq, void *p)
> {
> - u8 buffer[ALIGN(sizeof(u8), sizeof(s64)) + sizeof(s64)];
> struct iio_poll_func *pf = p;
> struct iio_dev *iio_dev = pf->indio_dev;
> struct st_uvis25_hw *hw = iio_priv(iio_dev);
> int err;
>
> - err = regmap_read(hw->regmap, ST_UVIS25_REG_OUT_ADDR, (int *)buffer);
> + err = regmap_read(hw->regmap, ST_UVIS25_REG_OUT_ADDR,
> + (unsigned int *)&hw->scan.chan);
> if (err < 0)
> goto out;
>
> - iio_push_to_buffers_with_timestamp(iio_dev, buffer,
> + iio_push_to_buffers_with_timestamp(iio_dev, &hw->scan,
> iio_get_time_ns(iio_dev));
>
> out:
