diff mbox series

[05/19] iio: accel: mxc4005: Fix overread of data and alignment issue.

Message ID 20210501170121.512209-6-jic23@kernel.org (mailing list archive)
State New, archived
Headers show
Series IIO: Alignment fixes part 2 - struct used to ensure alignment | expand

Commit Message

Jonathan Cameron May 1, 2021, 5:01 p.m. UTC
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

The bulk read size is based on the size of an array that also has
space for the timestamp alongside the channels.
Fix that and also fix alignment of the buffer passed
to iio_push_to_buffers_with_timestamp.

Found during an audit of all calls to this function.

Fixes: 1ce0eda0f757 ("iio: mxc4005: add triggered buffer mode for mxc4005")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/accel/mxc4005.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

Comments

Jonathan Cameron May 13, 2021, 5:37 p.m. UTC | #1
On Sat,  1 May 2021 18:01:07 +0100
Jonathan Cameron <jic23@kernel.org> wrote:

> From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> 
> The bulk read size is based on the size of an array that also has
> space for the timestamp alongside the channels.
> Fix that and also fix alignment of the buffer passed
> to iio_push_to_buffers_with_timestamp.
> 
> Found during an audit of all calls to this function.
> 
> Fixes: 1ce0eda0f757 ("iio: mxc4005: add triggered buffer mode for mxc4005")
> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

Applied to the togreg branch of iio.git and pushed out as testing for the
autobuilders to see if they can find anything.  Minor tweak to enforce the
8 byte alignment as done in other drivers.
> ---
>  drivers/iio/accel/mxc4005.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/iio/accel/mxc4005.c b/drivers/iio/accel/mxc4005.c
> index fb3cbaa62bd8..9e6066c6a2df 100644
> --- a/drivers/iio/accel/mxc4005.c
> +++ b/drivers/iio/accel/mxc4005.c
> @@ -56,7 +56,11 @@ struct mxc4005_data {
>  	struct mutex mutex;
>  	struct regmap *regmap;
>  	struct iio_trigger *dready_trig;
> -	__be16 buffer[8];
> +	/* Ensure timestamp is naturally aligned */
> +	struct {
> +		__be16 chans[3];
> +		s64 timestamp;
Added __aligned(8) here to be consistent and ensure natural alignment.

> +	} scan;
>  	bool trigger_enabled;
>  };
>  
> @@ -135,7 +139,7 @@ static int mxc4005_read_xyz(struct mxc4005_data *data)
>  	int ret;
>  
>  	ret = regmap_bulk_read(data->regmap, MXC4005_REG_XOUT_UPPER,
> -			       data->buffer, sizeof(data->buffer));
> +			       data->scan.chans, sizeof(data->scan.chans));
>  	if (ret < 0) {
>  		dev_err(data->dev, "failed to read axes\n");
>  		return ret;
> @@ -301,7 +305,7 @@ static irqreturn_t mxc4005_trigger_handler(int irq, void *private)
>  	if (ret < 0)
>  		goto err;
>  
> -	iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
> +	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
>  					   pf->timestamp);
>  
>  err:
diff mbox series

Patch

diff --git a/drivers/iio/accel/mxc4005.c b/drivers/iio/accel/mxc4005.c
index fb3cbaa62bd8..9e6066c6a2df 100644
--- a/drivers/iio/accel/mxc4005.c
+++ b/drivers/iio/accel/mxc4005.c
@@ -56,7 +56,11 @@  struct mxc4005_data {
 	struct mutex mutex;
 	struct regmap *regmap;
 	struct iio_trigger *dready_trig;
-	__be16 buffer[8];
+	/* Ensure timestamp is naturally aligned */
+	struct {
+		__be16 chans[3];
+		s64 timestamp;
+	} scan;
 	bool trigger_enabled;
 };
 
@@ -135,7 +139,7 @@  static int mxc4005_read_xyz(struct mxc4005_data *data)
 	int ret;
 
 	ret = regmap_bulk_read(data->regmap, MXC4005_REG_XOUT_UPPER,
-			       data->buffer, sizeof(data->buffer));
+			       data->scan.chans, sizeof(data->scan.chans));
 	if (ret < 0) {
 		dev_err(data->dev, "failed to read axes\n");
 		return ret;
@@ -301,7 +305,7 @@  static irqreturn_t mxc4005_trigger_handler(int irq, void *private)
 	if (ret < 0)
 		goto err;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
+	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
 					   pf->timestamp);
 
 err: