From patchwork Mon Jul 12 06:10:49 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 472868 Delivered-To: patch@linaro.org Received: by 2002:a02:c94a:0:0:0:0:0 with SMTP id u10csp2648607jao; Sun, 11 Jul 2021 23:31:02 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyl3bdt2FRBg6yMrBUnshEA28f+/GAhXu63nFWTrGQm7lFcWon+aILui+vVkCDmOt6TuT/n X-Received: by 2002:a17:906:8558:: with SMTP id h24mr19527782ejy.519.1626071349879; Sun, 11 Jul 2021 23:29:09 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1626071349; cv=none; d=google.com; s=arc-20160816; b=W1QeZBVez5u5AsOCltSM5IjgKaQewgqYtAxws3EqKZLQRuqhXxNxu7gWLEMQsG/rYq Yj6PMzl+MdsmS/p/B7rpt5NkkqJtp5dnBZRWp/tLP4VvyT1y99O1lS9eaLy/0S8mY+cw 6JgAKN6d5xLeZsZ57Y4xUNoWMaykYwOHhPxmGKKcETy2gEwv5Igal0gtgz0MiBJbjFso SMdumSExBbdNqldurvruqSDFp6Ojmw01+khwLnam/4KwuPfF6F3WsxqsdRQ32o6qSExC 7s9T83K/HbBYxhc5oGUtzoHAAXktv5vu+PX3Y7ItJjk+3cL21/cAemirbIw5v4jc55gv eJIg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=iWaBBbUH9TAkaqL9YjhZEHrKEFQ3JCZCiaAxavRcQ8I=; b=lhiBEr0UtTiiaxEjRVh7Q50/ryGkPeEclmP0K9fkOtIrr8tQuzJi1ixzO22VFaGxEL T2B9dRebVSfisSLnmZ1O44tcs37z5zqCuANfmncKf+I3E6L2w1SsZ/7WWNGwZiWozLnt PgR3yQ9B1T0XTfdGM5KGgjEHX7J6X780fNUbFus31+BUdDfsA6E0frbCBp/2K+/lLVeY Mp2cIHzfUYBC7Tqr2cU1Qu3dBsCF14FcLsMj3Z+Jy7mrPjzec5S3NXhcZGc2tgW3hw1K YlvFZ1VQPncPScS/ClLP+n2wnbYwfk8bi8WWUm88OeQ4zrIPMOJWV138aGA5oTFOdNeM 6XFA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=1i+zkRd4; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id bz6si16420285ejc.610.2021.07.11.23.29.09; Sun, 11 Jul 2021 23:29:09 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=1i+zkRd4; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234348AbhGLGbR (ORCPT + 12 others); Mon, 12 Jul 2021 02:31:17 -0400 Received: from mail.kernel.org ([198.145.29.99]:46224 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235157AbhGLG2Z (ORCPT ); Mon, 12 Jul 2021 02:28:25 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 3299561004; Mon, 12 Jul 2021 06:24:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1626071076; bh=iOCJ63eUXxFDlQ8FN5hBdPSYIDOOypkaYhYrxvoP5e8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1i+zkRd4Cx4+0IVXlFODJP4Bvqsyfk4Jb5Pa/zI4yjvPTdpXeITcZtMDIXKT7SX08 FYAa2CCUgEUH4WdEbvnE6gxlUSt6tbRSHiMZKURAK1xLJ4ftshz9w3gbXLlAF/RsQG jPy1TrlC2AexUNatHssYxF9ZDQt9jpWtw1A1C1Fw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Cameron , Andy Shevchenko , Sasha Levin Subject: [PATCH 5.4 265/348] iio: accel: mxc4005: Fix overread of data and alignment issue. Date: Mon, 12 Jul 2021 08:10:49 +0200 Message-Id: <20210712060738.532620700@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210712060659.886176320@linuxfoundation.org> References: <20210712060659.886176320@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jonathan Cameron [ Upstream commit f65802284a3a337510d7f8f916c97d66c74f2e71 ] The bulk read size is based on the size of an array that also has space for the timestamp alongside the channels. Fix that and also fix alignment of the buffer passed to iio_push_to_buffers_with_timestamp. Found during an audit of all calls to this function. Fixes: 1ce0eda0f757 ("iio: mxc4005: add triggered buffer mode for mxc4005") Signed-off-by: Jonathan Cameron Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20210501170121.512209-6-jic23@kernel.org Signed-off-by: Sasha Levin --- drivers/iio/accel/mxc4005.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) -- 2.30.2 diff --git a/drivers/iio/accel/mxc4005.c b/drivers/iio/accel/mxc4005.c index 9d07642c0de1..d81b02642a0b 100644 --- a/drivers/iio/accel/mxc4005.c +++ b/drivers/iio/accel/mxc4005.c @@ -56,7 +56,11 @@ struct mxc4005_data { struct mutex mutex; struct regmap *regmap; struct iio_trigger *dready_trig; - __be16 buffer[8]; + /* Ensure timestamp is naturally aligned */ + struct { + __be16 chans[3]; + s64 timestamp __aligned(8); + } scan; bool trigger_enabled; }; @@ -135,7 +139,7 @@ static int mxc4005_read_xyz(struct mxc4005_data *data) int ret; ret = regmap_bulk_read(data->regmap, MXC4005_REG_XOUT_UPPER, - data->buffer, sizeof(data->buffer)); + data->scan.chans, sizeof(data->scan.chans)); if (ret < 0) { dev_err(data->dev, "failed to read axes\n"); return ret; @@ -301,7 +305,7 @@ static irqreturn_t mxc4005_trigger_handler(int irq, void *private) if (ret < 0) goto err; - iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, + iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, pf->timestamp); err: