Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit baf22f66 authored by Jonathan Cameron's avatar Jonathan Cameron Committed by Greg Kroah-Hartman
Browse files

iio:health:afe4403 Fix timestamp alignment and prevent data leak. 



commit 3f9c6d38797e9903937b007a341dad0c251765d6 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 32 byte array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data with alignment
explicitly requested.  This data is allocated with kzalloc so no
data can leak appart from previous readings.

Fixes: eec96d1e ("iio: health: Add driver for the TI AFE4403 heart monitor")
Reported-by: default avatarLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: default avatarAndrew F. Davis <afd@ti.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 5f8fe8ab

drivers/iio/health/afe4403.c

+8 −5
Original line number Diff line number Diff line
@@ -63,6 +63,7 @@ static const struct reg_field afe4403_reg_fields[] = { 
 * @regulator: Pointer to the regulator for the IC

 * @trig: IIO trigger for this device

 * @irq: ADC_RDY line interrupt number

 * @buffer: Used to construct data layout to push into IIO buffer.

 */

struct afe4403_data {

	struct device *dev;
@@ -72,6 +73,8 @@ struct afe4403_data { 
	struct regulator *regulator;

	struct iio_trigger *trig;

	int irq;

	/* Ensure suitable alignment for timestamp */

	s32 buffer[8] __aligned(8);

};



enum afe4403_chan_id {
@@ -309,7 +312,6 @@ static irqreturn_t afe4403_trigger_handler(int irq, void *private) 
	struct iio_dev *indio_dev = pf->indio_dev;

	struct afe4403_data *afe = iio_priv(indio_dev);

	int ret, bit, i = 0;

	s32 buffer[8];

	u8 tx[4] = {AFE440X_CONTROL0, 0x0, 0x0, AFE440X_CONTROL0_READ};

	u8 rx[3];
@@ -326,7 +328,7 @@ static irqreturn_t afe4403_trigger_handler(int irq, void *private) 
		if (ret)

			goto err;



		buffer[i++] = (rx[0] << 16) |

		afe->buffer[i++] = (rx[0] << 16) |

				   (rx[1] << 8) |

				   (rx[2]);

	}
@@ -337,7 +339,8 @@ static irqreturn_t afe4403_trigger_handler(int irq, void *private) 
	if (ret)

		goto err;



	iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp);

	iio_push_to_buffers_with_timestamp(indio_dev, afe->buffer,

					   pf->timestamp);

err:

	iio_trigger_notify_done(indio_dev->trig);