From patchwork Tue Nov 3 20:36:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 320459 Delivered-To: patch@linaro.org Received: by 2002:a92:7b12:0:0:0:0:0 with SMTP id w18csp4905664ilc; Tue, 3 Nov 2020 12:58:47 -0800 (PST) X-Google-Smtp-Source: ABdhPJyKQgQcfbCEZ7eOU9rDvz3+mXWAO5SDH3W+QZhJ//yIyMXkOpxUOIt35A/qYNJw4YpsDlK9 X-Received: by 2002:a17:906:bce6:: with SMTP id op6mr12502107ejb.2.1604437127218; Tue, 03 Nov 2020 12:58:47 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1604437127; cv=none; d=google.com; s=arc-20160816; b=ZCy9P6TLQJkyX5tOUa5C9dglFwgo5ophF+nNCJ8L+OCg8fVIPrH/A9z1IFwG7KkG2Z NWeVrfc8zfO9eFjR7b0nwErX7lHHmT/VAtUyq8sqtoISiASuLq+awCf4b7b55vNYKUD2 FaD0wJC9Zh6M80MJCdzKKOhV/RBj/WJIpH1Ym8V110TGsOJqxy3oSQY3xcloyEudDTbn YrP429CA2J6xqHa2Br/b38vUiGvXcgOuVYhw3bMwhpGUfHzriI9735q6zI95rSYLjPvn mD7rORC6JcpAqSq5EmUxRwgicf6kBLXYWulDxsNeDXlgrTO7GOg+hruEBpNlTuWOoMXQ QAPA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=6nw8xFIk5vFvt5YOTaK3X+v6PnG0arCAN7ymVPn1j/I=; b=x2W1ZYo/MhnRE6u51pRFVtGiPaU1ul/t5Ezm82pjqgr7jEHNS0jm2LplVvVGlUkYYg MzvsC1KNLwh3AW+0txUldwa8Zn4mwfAxm7yxT3Rq7fH44XGvklu9XJnvvgHHzgHQS9Cn Fw23T+wlijIB9H+ccPIRCnsPkLtBLKDaLQou6Q4puczoYJUArwGT5jPsZw34IMv2cznf lKLSEZezT6u0XgmzzdZDRDJiSvIBdU+gkUOxsdEZayJMVLqY06yzZE1Cns8qjKSpn5JQ FS8iE/EcLBZdqu5YUtZNPtCWUJoR4CtisvgHowBSc8RJQQRQyvZvmRKGxxDSmZ1Z1GHW 6xgA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=S0pNuvx4; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id rn4si33962ejb.174.2020.11.03.12.58.46; Tue, 03 Nov 2020 12:58:47 -0800 (PST) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=S0pNuvx4; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732342AbgKCU6p (ORCPT + 15 others); Tue, 3 Nov 2020 15:58:45 -0500 Received: from mail.kernel.org ([198.145.29.99]:33278 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732997AbgKCU6n (ORCPT ); Tue, 3 Nov 2020 15:58:43 -0500 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DB31A223BF; Tue, 3 Nov 2020 20:58:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604437121; bh=3iK3aVReR0jqP67eQryy4jne8FcaTAU+6QLhdiub758=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=S0pNuvx4pL0GX5ozlhrz6Mp8o0+VWj2LZLbAPRqX3XUZzwOpSm9Ql2D/mL9LdWmoS TP3zjcvGSJcl15O1cGyPVD0aDYTr+AfuxuNExJxF53MBZByLPewWrfZ4mQUAKVX/sA QM2j7J0j9wQUK7yrDtNDf5mC1XhTvMMkpRR5kpAs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lars-Peter Clausen , Jonathan Cameron , Andy Shevchenko , Akinobu Mita , Stable@vger.kernel.org Subject: [PATCH 5.4 153/214] iio:adc:ti-adc12138 Fix alignment issue with timestamp Date: Tue, 3 Nov 2020 21:36:41 +0100 Message-Id: <20201103203305.129572129@linuxfoundation.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201103203249.448706377@linuxfoundation.org> References: <20201103203249.448706377@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jonathan Cameron commit 293e809b2e8e608b65a949101aaf7c0bd1224247 upstream. One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. We move to a suitable structure in the iio_priv() data with alignment explicitly requested. This data is allocated with kzalloc so no data can leak apart from previous readings. Note that previously no leak at all could occur, but previous readings should never be a problem. In this case the timestamp location depends on what other channels are enabled. As such we can't use a structure without misleading by suggesting only one possible timestamp location. Fixes: 50a6edb1b6e0 ("iio: adc: add ADC12130/ADC12132/ADC12138 ADC driver") Reported-by: Lars-Peter Clausen Signed-off-by: Jonathan Cameron Reviewed-by: Andy Shevchenko Cc: Akinobu Mita Cc: Link: https://lore.kernel.org/r/20200722155103.979802-26-jic23@kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/iio/adc/ti-adc12138.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) --- a/drivers/iio/adc/ti-adc12138.c +++ b/drivers/iio/adc/ti-adc12138.c @@ -47,6 +47,12 @@ struct adc12138 { struct completion complete; /* The number of cclk periods for the S/H's acquisition time */ unsigned int acquisition_time; + /* + * Maximum size needed: 16x 2 bytes ADC data + 8 bytes timestamp. + * Less may be need if not all channels are enabled, as long as + * the 8 byte alignment of the timestamp is maintained. + */ + __be16 data[20] __aligned(8); u8 tx_buf[2] ____cacheline_aligned; u8 rx_buf[2]; @@ -329,7 +335,6 @@ static irqreturn_t adc12138_trigger_hand struct iio_poll_func *pf = p; struct iio_dev *indio_dev = pf->indio_dev; struct adc12138 *adc = iio_priv(indio_dev); - __be16 data[20] = { }; /* 16x 2 bytes ADC data + 8 bytes timestamp */ __be16 trash; int ret; int scan_index; @@ -345,7 +350,7 @@ static irqreturn_t adc12138_trigger_hand reinit_completion(&adc->complete); ret = adc12138_start_and_read_conv(adc, scan_chan, - i ? &data[i - 1] : &trash); + i ? &adc->data[i - 1] : &trash); if (ret) { dev_warn(&adc->spi->dev, "failed to start conversion\n"); @@ -362,7 +367,7 @@ static irqreturn_t adc12138_trigger_hand } if (i) { - ret = adc12138_read_conv_data(adc, &data[i - 1]); + ret = adc12138_read_conv_data(adc, &adc->data[i - 1]); if (ret) { dev_warn(&adc->spi->dev, "failed to get conversion data\n"); @@ -370,7 +375,7 @@ static irqreturn_t adc12138_trigger_hand } } - iio_push_to_buffers_with_timestamp(indio_dev, data, + iio_push_to_buffers_with_timestamp(indio_dev, adc->data, iio_get_time_ns(indio_dev)); out: mutex_unlock(&adc->lock);