diff options
author | Jonathan Cameron <Jonathan.Cameron@huawei.com> | 2020-07-22 16:50:38 +0100 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-09-23 08:46:11 +0200 |
commit | 7bc5f67e115c35e760f5bf5cbbdff26fa9f78a60 (patch) | |
tree | 7c49331ab9801b05a5f20610ae68383eef7224ed /include | |
parent | 69be3977fbebb1dbe96f4f596aa4396641065f5d (diff) | |
download | linux-stable-7bc5f67e115c35e760f5bf5cbbdff26fa9f78a60.tar.gz linux-stable-7bc5f67e115c35e760f5bf5cbbdff26fa9f78a60.tar.bz2 linux-stable-7bc5f67e115c35e760f5bf5cbbdff26fa9f78a60.zip |
iio:accel:mma8452: Fix timestamp alignment and prevent data leak.
commit 89226a296d816727405d3fea684ef69e7d388bd8 upstream.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses a 16 byte u8 array on the stack. As Lars also noted
this anti pattern can involve a leak of data to userspace and that
indeed can happen here. We close both issues by moving to
a suitable structure in the iio_priv() data with alignment
ensured by use of an explicit c structure. This data is allocated
with kzalloc so no data can leak appart from previous readings.
The additional forcing of the 8 byte alignment of the timestamp
is not strictly necessary but makes the code less fragile by
making this explicit.
Fixes: c7eeea93ac60 ("iio: Add Freescale MMA8452Q 3-axis accelerometer driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: Peter Meerwald <pmeerw@pmeerw.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions