| Message ID | 20200517173000.220819-11-jic23@kernel.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | IIO: 1st set of timestamp alignment fixes. | expand |
On Sun, May 17, 2020 at 06:29:59PM +0100, jic23@kernel.org wrote: > From: Jonathan Cameron <Jonathan.Cameron@huawei.com> > > One of a class of bugs pointed out by Lars in a recent review. > iio_push_to_buffers_with_timestamp assumes the buffer used is aligned > to the size of the timestamp (8 bytes). This is not guaranteed in > this driver which uses an array of smaller elements on the stack. > > Fixes: 232e0f6ddeae ("iio: chemical: add support for Sensirion SPS30 sensor") > Reported-by: Lars-Peter Clausen <lars@metafoo.de> > Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> > Cc: Tomasz Duszynski <tduszyns@gmail.com> > --- > drivers/iio/chemical/sps30.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/drivers/iio/chemical/sps30.c b/drivers/iio/chemical/sps30.c > index acb9f8ecbb3d..a88c1fb875a0 100644 > --- a/drivers/iio/chemical/sps30.c > +++ b/drivers/iio/chemical/sps30.c > @@ -230,15 +230,18 @@ static irqreturn_t sps30_trigger_handler(int irq, void *p) > struct iio_dev *indio_dev = pf->indio_dev; > struct sps30_state *state = iio_priv(indio_dev); > int ret; > - s32 data[4 + 2]; /* PM1, PM2P5, PM4, PM10, timestamp */ > + struct { > + s32 data[4]; /* PM1, PM2P5, PM4, PM10 */ > + s64 ts; > + } scan; > > mutex_lock(&state->lock); > - ret = sps30_do_meas(state, data, 4); > + ret = sps30_do_meas(state, scan.data, ARRAY_SIZE(scan.data)); > mutex_unlock(&state->lock); > if (ret) > goto err; > > - iio_push_to_buffers_with_timestamp(indio_dev, data, > + iio_push_to_buffers_with_timestamp(indio_dev, &scan, > iio_get_time_ns(indio_dev)); > err: > iio_trigger_notify_done(indio_dev->trig); > -- > 2.26.2 > Thanks for the fix. Acked-by: Tomasz Duszynski <tomasz.duszynski@octakon.com>
On Sun, 17 May 2020 21:07:28 +0200 Tomasz Duszynski <tomasz.duszynski@octakon.com> wrote: > On Sun, May 17, 2020 at 06:29:59PM +0100, jic23@kernel.org wrote: > > From: Jonathan Cameron <Jonathan.Cameron@huawei.com> > > > > One of a class of bugs pointed out by Lars in a recent review. > > iio_push_to_buffers_with_timestamp assumes the buffer used is aligned > > to the size of the timestamp (8 bytes). This is not guaranteed in > > this driver which uses an array of smaller elements on the stack. > > > > Fixes: 232e0f6ddeae ("iio: chemical: add support for Sensirion SPS30 sensor") > > Reported-by: Lars-Peter Clausen <lars@metafoo.de> > > Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> > > Cc: Tomasz Duszynski <tduszyns@gmail.com> > > --- > > drivers/iio/chemical/sps30.c | 9 ++++++--- > > 1 file changed, 6 insertions(+), 3 deletions(-) > > > > diff --git a/drivers/iio/chemical/sps30.c b/drivers/iio/chemical/sps30.c > > index acb9f8ecbb3d..a88c1fb875a0 100644 > > --- a/drivers/iio/chemical/sps30.c > > +++ b/drivers/iio/chemical/sps30.c > > @@ -230,15 +230,18 @@ static irqreturn_t sps30_trigger_handler(int irq, void *p) > > struct iio_dev *indio_dev = pf->indio_dev; > > struct sps30_state *state = iio_priv(indio_dev); > > int ret; > > - s32 data[4 + 2]; /* PM1, PM2P5, PM4, PM10, timestamp */ > > + struct { > > + s32 data[4]; /* PM1, PM2P5, PM4, PM10 */ > > + s64 ts; > > + } scan; > > > > mutex_lock(&state->lock); > > - ret = sps30_do_meas(state, data, 4); > > + ret = sps30_do_meas(state, scan.data, ARRAY_SIZE(scan.data)); > > mutex_unlock(&state->lock); > > if (ret) > > goto err; > > > > - iio_push_to_buffers_with_timestamp(indio_dev, data, > > + iio_push_to_buffers_with_timestamp(indio_dev, &scan, > > iio_get_time_ns(indio_dev)); > > err: > > iio_trigger_notify_done(indio_dev->trig); > > -- > > 2.26.2 > > > > Thanks for the fix. > Acked-by: Tomasz Duszynski <tomasz.duszynski@octakon.com> Applied to the fixes-togreg branch of iio.git. I'm going to pick these up as and when I get reviews for them rather than waiting for the whole series to have suitable reviews. They are a small part of all the instances we have of this issue so no point in waiting. Thanks, Jonathan
diff --git a/drivers/iio/chemical/sps30.c b/drivers/iio/chemical/sps30.c index acb9f8ecbb3d..a88c1fb875a0 100644 --- a/drivers/iio/chemical/sps30.c +++ b/drivers/iio/chemical/sps30.c @@ -230,15 +230,18 @@ static irqreturn_t sps30_trigger_handler(int irq, void *p) struct iio_dev *indio_dev = pf->indio_dev; struct sps30_state *state = iio_priv(indio_dev); int ret; - s32 data[4 + 2]; /* PM1, PM2P5, PM4, PM10, timestamp */ + struct { + s32 data[4]; /* PM1, PM2P5, PM4, PM10 */ + s64 ts; + } scan; mutex_lock(&state->lock); - ret = sps30_do_meas(state, data, 4); + ret = sps30_do_meas(state, scan.data, ARRAY_SIZE(scan.data)); mutex_unlock(&state->lock); if (ret) goto err; - iio_push_to_buffers_with_timestamp(indio_dev, data, + iio_push_to_buffers_with_timestamp(indio_dev, &scan, iio_get_time_ns(indio_dev)); err: iio_trigger_notify_done(indio_dev->trig);