Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 98596300 authored by Jonathan Cameron's avatar Jonathan Cameron Committed by Greg Kroah-Hartman
Browse files

iio:health:afe4404 Fix timestamp alignment and prevent data leak. 



[ Upstream commit f88ecccac4be348bbcc6d056bdbc622a8955c04d ]

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 40 byte array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data with alignment
explicitly requested.  This data is allocated with kzalloc so no
data can leak appart from previous readings.

Fixes: 87aec56e ("iio: health: Add driver for the TI AFE4404 heart monitor")
Reported-by: default avatarLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: default avatarAndrew F. Davis <afd@ti.com>
Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 78598eff

drivers/iio/health/afe4404.c

+5 −3
Original line number Diff line number Diff line
@@ -91,6 +91,7 @@ static const struct reg_field afe4404_reg_fields[] = { 
 * @regulator: Pointer to the regulator for the IC

 * @trig: IIO trigger for this device

 * @irq: ADC_RDY line interrupt number

 * @buffer: Used to construct a scan to push to the iio buffer.

 */

struct afe4404_data {

	struct device *dev;
@@ -99,6 +100,7 @@ struct afe4404_data { 
	struct regulator *regulator;

	struct iio_trigger *trig;

	int irq;

	s32 buffer[10] __aligned(8);

};



enum afe4404_chan_id {
@@ -336,17 +338,17 @@ static irqreturn_t afe4404_trigger_handler(int irq, void *private) 
	struct iio_dev *indio_dev = pf->indio_dev;

	struct afe4404_data *afe = iio_priv(indio_dev);

	int ret, bit, i = 0;

	s32 buffer[10];



	for_each_set_bit(bit, indio_dev->active_scan_mask,

			 indio_dev->masklength) {

		ret = regmap_read(afe->regmap, afe4404_channel_values[bit],

				  &buffer[i++]);

				  &afe->buffer[i++]);

		if (ret)

			goto err;

	}



	iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp);

	iio_push_to_buffers_with_timestamp(indio_dev, afe->buffer,

					   pf->timestamp);

err:

	iio_trigger_notify_done(indio_dev->trig);