From patchwork Mon Jul 12 06:10:19 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 472970 Delivered-To: patch@linaro.org Received: by 2002:a02:c94a:0:0:0:0:0 with SMTP id u10csp2683362jao; Mon, 12 Jul 2021 00:24:02 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzO2dB+akUczNFNgiPbGAIMH/HqReoYFFggVMW5M3ALnKL4xZozqe+T4/j4xCIyIurUjJ7V X-Received: by 2002:a05:6402:1911:: with SMTP id e17mr63000516edz.36.1626074642272; Mon, 12 Jul 2021 00:24:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1626074642; cv=none; d=google.com; s=arc-20160816; b=X3w+AEdwwoEhORu4/QFVpXeX29aJOsrt/UsRltWlXxlC/0TO9oPNury8jCXqLSsjdd HVHvQCO5iiBR00c6c0ZHKHX5x6B46LUkPMmKeRTGW9fu2auXV0ycIL8YGUfBHWRvBvAY OkxGdIOR4N21gZ8IzIQZGiDQv0iTPo7FsVnjSph9gA5mtLAjuM2/4mD/CzkqwTd1Ys9e 8mTznl9V+ZZjKwZgNqkJL7XLaF9PHkTmN+ho1e4vBTlGP79QchD2q/OdY5Y8rQ6U99rd N06guCKFEaIRCz8IS/7bDPZgBPojSq6x2xGpPw4Rkosidzqj4xPR8DcKk5KpZerta7ay n/VA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=gdT2xl8O35zoql0zcaaZTKlRATXHYrT7MpmDBYWtbnk=; b=qUQeOSIZMjj2H01I9+VLfH0z5Zzz+7oRydqCBVPE5sUqBWz1HYgE3qK+y91QMIqeu2 vtnhMiMXF/NU66ysywkZ1xJ7MNJpFs+3BOqFgVguCviD99rWI+v1JU4hI9VRHG77kJ4q tJ4JDG4y4F5i5OeVRjDKPzIi9/S2AugdAOOJPZsQ+ek0QD9kt3KLdKt+qRm7XbRKZkl3 Tq8s52blE1ym1plh6+Sq3Qh5sqlnZJLcYrr5aqrG72Ntvt0BvlZ/DoD/A/Gwj1au6XoG 8f3kZeW99DlMjJ6JJI0x8KHmARXJUQnScLy6iBim/CgcNPuDnKYATDblUVH6EX6oGvjc +F+w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=h4dvzllA; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id d9si16909677edq.169.2021.07.12.00.24.02; Mon, 12 Jul 2021 00:24:02 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=h4dvzllA; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243075AbhGLH0I (ORCPT + 12 others); Mon, 12 Jul 2021 03:26:08 -0400 Received: from mail.kernel.org ([198.145.29.99]:33388 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241605AbhGLHXX (ORCPT ); Mon, 12 Jul 2021 03:23:23 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id A6CC7613D2; Mon, 12 Jul 2021 07:20:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1626074435; bh=QSydydaOeiV92pEB+alYQ1Mmy9cb8edOzGZOWtv08LQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h4dvzllAA3ln3QvZMZ3PJSLaMM46dRBMfEEe9sRW/WBFN3+TDDcCxhX/MUBmdiKWB YWUfeMe4y8tGgWsjUmLNlJjbsDPSRRcNY5MiaAryPLQiHn/5P/CiWEeQrkTsqL0taQ 3X3KkkOVHAGkcaTbBbeu2n8FRHB4rlzuuCkke9Yw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Cameron , Andy Shevchenko , Sasha Levin Subject: [PATCH 5.12 536/700] iio: accel: mxc4005: Fix overread of data and alignment issue. Date: Mon, 12 Jul 2021 08:10:19 +0200 Message-Id: <20210712061033.461490983@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210712060924.797321836@linuxfoundation.org> References: <20210712060924.797321836@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jonathan Cameron [ Upstream commit f65802284a3a337510d7f8f916c97d66c74f2e71 ] The bulk read size is based on the size of an array that also has space for the timestamp alongside the channels. Fix that and also fix alignment of the buffer passed to iio_push_to_buffers_with_timestamp. Found during an audit of all calls to this function. Fixes: 1ce0eda0f757 ("iio: mxc4005: add triggered buffer mode for mxc4005") Signed-off-by: Jonathan Cameron Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20210501170121.512209-6-jic23@kernel.org Signed-off-by: Sasha Levin --- drivers/iio/accel/mxc4005.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) -- 2.30.2 diff --git a/drivers/iio/accel/mxc4005.c b/drivers/iio/accel/mxc4005.c index 0f8fd687866d..381c6b1be5f5 100644 --- a/drivers/iio/accel/mxc4005.c +++ b/drivers/iio/accel/mxc4005.c @@ -56,7 +56,11 @@ struct mxc4005_data { struct mutex mutex; struct regmap *regmap; struct iio_trigger *dready_trig; - __be16 buffer[8]; + /* Ensure timestamp is naturally aligned */ + struct { + __be16 chans[3]; + s64 timestamp __aligned(8); + } scan; bool trigger_enabled; }; @@ -135,7 +139,7 @@ static int mxc4005_read_xyz(struct mxc4005_data *data) int ret; ret = regmap_bulk_read(data->regmap, MXC4005_REG_XOUT_UPPER, - data->buffer, sizeof(data->buffer)); + data->scan.chans, sizeof(data->scan.chans)); if (ret < 0) { dev_err(data->dev, "failed to read axes\n"); return ret; @@ -301,7 +305,7 @@ static irqreturn_t mxc4005_trigger_handler(int irq, void *private) if (ret < 0) goto err; - iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, + iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, pf->timestamp); err: