From patchwork Mon May 25 17:06:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jonathan Cameron X-Patchwork-Id: 11569113 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C72CA739 for ; Mon, 25 May 2020 17:09:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A6AB620723 for ; Mon, 25 May 2020 17:09:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1590426564; bh=GIXYLtXq1Eg29sZPC/QkiQGfghod5tYMkm1NEimzBXk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=PXnDZA1MBLlidTQNGTjCXVPAO7dqik5XqqHw3+ppTz4PB9tB49CNO7+RXwc/NfIb+ ZbxLHS9mieC8zTXCnhXLUHSYviPt+0drIxBOeL/6ljDXJ+2hag2oi5t17R8uCNDd6T UjsJzri3IHXw0RHTzK/M8PeZsBa7bZ0qTJVkUqoM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2391304AbgEYRJY (ORCPT ); Mon, 25 May 2020 13:09:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:42846 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2391301AbgEYRJX (ORCPT ); Mon, 25 May 2020 13:09:23 -0400 Received: from localhost.localdomain (cpc149474-cmbg20-2-0-cust94.5-4.cable.virginm.net [82.4.196.95]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 764ED2078B; Mon, 25 May 2020 17:09:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1590426563; bh=GIXYLtXq1Eg29sZPC/QkiQGfghod5tYMkm1NEimzBXk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1dljblTPtUW/QOZRiFoIV62X7qqBq/CoEHaCecWJB1Qukwp3hxcNBEZlS4Yx6CXRE F2m9TPqvUuhWqk7lzelU81JNHydsEn2bN1gsYB0xdUEG8vaIstcBFNg/ClcnW0z96a tcclGEfx+X4A+L6ZoI4lAsVy0O8C60pXtSino5QQ= From: Jonathan Cameron To: linux-iio@vger.kernel.org Cc: Jonathan Cameron , Lars-Peter Clausen , Andy Shevchenko Subject: [PATCH 19/25] iio:adc:ti-ads1015 Fix buffer element alignment Date: Mon, 25 May 2020 18:06:22 +0100 Message-Id: <20200525170628.503283-20-jic23@kernel.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200525170628.503283-1-jic23@kernel.org> References: <20200525170628.503283-1-jic23@kernel.org> MIME-Version: 1.0 Sender: linux-iio-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-iio@vger.kernel.org From: Jonathan Cameron One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. Here we use an explicit structure and rely on that to enforce alignment on the stack. Note there was never a data leak here due to the explicit memset. Fixes: ecc24e72f437 ("iio: adc: Add TI ADS1015 ADC driver support") Reported-by: Lars-Peter Clausen Signed-off-by: Jonathan Cameron Cc: Andy Shevchenko --- drivers/iio/adc/ti-ads1015.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c index 5ea4f45d6bad..05853723dbdb 100644 --- a/drivers/iio/adc/ti-ads1015.c +++ b/drivers/iio/adc/ti-ads1015.c @@ -385,10 +385,14 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p) struct iio_poll_func *pf = p; struct iio_dev *indio_dev = pf->indio_dev; struct ads1015_data *data = iio_priv(indio_dev); - s16 buf[8]; /* 1x s16 ADC val + 3x s16 padding + 4x s16 timestamp */ + /* Ensure natural alignment for buffer elements */ + struct { + s16 channel; + s64 ts; + } scan; int chan, ret, res; - memset(buf, 0, sizeof(buf)); + memset(&scan, 0, sizeof(scan)); mutex_lock(&data->lock); chan = find_first_bit(indio_dev->active_scan_mask, @@ -399,10 +403,10 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p) goto err; } - buf[0] = res; + scan.channel = res; mutex_unlock(&data->lock); - iio_push_to_buffers_with_timestamp(indio_dev, buf, + iio_push_to_buffers_with_timestamp(indio_dev, &scan, iio_get_time_ns(indio_dev)); err: