From patchwork Mon Jul 12 06:10:43 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 473029 Delivered-To: patch@linaro.org Received: by 2002:a02:c94a:0:0:0:0:0 with SMTP id u10csp2713687jao; Mon, 12 Jul 2021 01:10:49 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwZ/xLCu4aAQpDIDjWKGTtcLILEdz2cYIsaAiYiE4IOuXgPEdElGfxOQcXuBYBAHN2SlCF9 X-Received: by 2002:a17:906:3a19:: with SMTP id z25mr1080478eje.536.1626077448834; Mon, 12 Jul 2021 01:10:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1626077448; cv=none; d=google.com; s=arc-20160816; b=eh4tOre1gcXz2ZFQs7V7GMze37aAP9Fa0DiX9XRqJwRmv7b091Opj81EJR589mZBrT /6IfzdyLjYnjstq5OXWm9/hHZA7REDb8VnDhgI/dM+bX4c2bbpNb8e1+5lTKPmnygFb3 priicOrypEVg9LPKpNiM8rk55hCioXbQdXBt9b0dlfGGzTIlTxp/N1n1AvB9BYOEehEj FLyawkLyHQVi6ALduHOCz4sXMM41v18Kpfu1Gu//RxdOlKy+S4JXjyg6uZLn2q0myQeR dkiU9ARwKd7t/F3wUElnTzsZ9cf7hGECQoI1N+i4M8ycR26hhtPveCP4ru7NyGaRaOvs ACyA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=InUFBD8oEu5Hd7J7+0KY31mHyyBYw8G3aQpI6gbV/3I=; b=geDCSSzxu0zVky5sU3Uvd5VXYBDoeMhrhCi634aqjB1CDjurNCHjY9KPo6aeV84w2l KiUPYsBQ+xd2Vd+i+Ct7cUgH6zGKI8eKi5rMix1DbbKz3Rnew5CrPvZ1EveoAHotw5rf /htXODa2KG5OJ7Kn4+D2za/trb2ESJ/BvRW6WA0GEtpEaOL4O1h0m0/KJH6jWWFLh0Ll QVQs3MRKayD63tLH0AI/PpkUMge0+N/0JDDu8tlIGwKYRVw13EXlsJpiDM78XR/Iaq0U luIORcvgGk4eMo9SeLUgaKTuGgdFtrLEOhiVJDwslf191aA60y2PwWgId0+sFlXXFpke Tmww== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=MoTcOVX5; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id n21si13642925eda.13.2021.07.12.01.10.48; Mon, 12 Jul 2021 01:10:48 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=MoTcOVX5; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245067AbhGLIJC (ORCPT + 12 others); Mon, 12 Jul 2021 04:09:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:44788 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348745AbhGLH6I (ORCPT ); Mon, 12 Jul 2021 03:58:08 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 160456198E; Mon, 12 Jul 2021 07:53:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1626076381; bh=0fcFkfXS++S6LeXO+H5NPjukED37EQGbjqkPhxBQZYA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MoTcOVX5rQsLOP790JmrZt4/C/uzJ9tdj81und2SnmLMj0dN/XEA74qFhPInlWwWI 5xWivBtSCVT65UAZgoUBmV49bZveyBxVcG6RubX8rIaxaH4QrkEEtwjGHR72EgYR7B QZSGwgQZCvVeBv0lCEVOWe1vCO/yznD95+Ah5nrU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Cameron , Andy Shevchenko , Sasha Levin Subject: [PATCH 5.13 620/800] iio: accel: mxc4005: Fix overread of data and alignment issue. Date: Mon, 12 Jul 2021 08:10:43 +0200 Message-Id: <20210712061033.249258721@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210712060912.995381202@linuxfoundation.org> References: <20210712060912.995381202@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jonathan Cameron [ Upstream commit f65802284a3a337510d7f8f916c97d66c74f2e71 ] The bulk read size is based on the size of an array that also has space for the timestamp alongside the channels. Fix that and also fix alignment of the buffer passed to iio_push_to_buffers_with_timestamp. Found during an audit of all calls to this function. Fixes: 1ce0eda0f757 ("iio: mxc4005: add triggered buffer mode for mxc4005") Signed-off-by: Jonathan Cameron Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20210501170121.512209-6-jic23@kernel.org Signed-off-by: Sasha Levin --- drivers/iio/accel/mxc4005.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) -- 2.30.2 diff --git a/drivers/iio/accel/mxc4005.c b/drivers/iio/accel/mxc4005.c index fb3cbaa62bd8..0f90e6ec01e1 100644 --- a/drivers/iio/accel/mxc4005.c +++ b/drivers/iio/accel/mxc4005.c @@ -56,7 +56,11 @@ struct mxc4005_data { struct mutex mutex; struct regmap *regmap; struct iio_trigger *dready_trig; - __be16 buffer[8]; + /* Ensure timestamp is naturally aligned */ + struct { + __be16 chans[3]; + s64 timestamp __aligned(8); + } scan; bool trigger_enabled; }; @@ -135,7 +139,7 @@ static int mxc4005_read_xyz(struct mxc4005_data *data) int ret; ret = regmap_bulk_read(data->regmap, MXC4005_REG_XOUT_UPPER, - data->buffer, sizeof(data->buffer)); + data->scan.chans, sizeof(data->scan.chans)); if (ret < 0) { dev_err(data->dev, "failed to read axes\n"); return ret; @@ -301,7 +305,7 @@ static irqreturn_t mxc4005_trigger_handler(int irq, void *private) if (ret < 0) goto err; - iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, + iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, pf->timestamp); err: