2022-01-12 20:35:01

by Kees Cook

Subject: [PATCH v2] iio: addac: ad74413r: Do not reference negative array offsets

Instead of aiming rx_buf at an invalid array-boundary-crossing location,
just skip the first increment. Seen when building with -Warray-bounds:

drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode':
drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds]
843 | u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 * AD74413R_FRAME_SIZE];
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf'
84 | u8 rx_buf[AD74413R_FRAME_SIZE * AD74413R_CHANNEL_MAX];
| ^~~~~~

Cc: Lars-Peter Clausen <[email protected]>
Cc: Michael Hennerich <[email protected]>
Cc: Jonathan Cameron <[email protected]>
Cc: [email protected]
Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
Reviewed-by: Cosmin Tanislav <[email protected]>
Signed-off-by: Kees Cook <[email protected]>
---
v1: https://lore.kernel.org/linux-hardening/[email protected]/
v2:
- Update commit Subject prefix
- add Reviewed-by
---
drivers/iio/addac/ad74413r.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/addac/ad74413r.c b/drivers/iio/addac/ad74413r.c
index 5271073bb74e..aba9a643a4ca 100644
--- a/drivers/iio/addac/ad74413r.c
+++ b/drivers/iio/addac/ad74413r.c
@@ -840,7 +840,7 @@ static int ad74413r_update_scan_mode(struct iio_dev *indio_dev,
{
struct ad74413r_state *st = iio_priv(indio_dev);
struct spi_transfer *xfer = st->adc_samples_xfer;
- u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 * AD74413R_FRAME_SIZE];
+ u8 *rx_buf = st->adc_samples_buf.rx_buf;
u8 *tx_buf = st->adc_samples_tx_buf;
unsigned int channel;
int ret = -EINVAL;
@@ -894,9 +894,10 @@ static int ad74413r_update_scan_mode(struct iio_dev *indio_dev,

spi_message_add_tail(xfer, &st->adc_samples_msg);

- xfer++;
tx_buf += AD74413R_FRAME_SIZE;
- rx_buf += AD74413R_FRAME_SIZE;
+ if (xfer != st->adc_samples_xfer)
+ rx_buf += AD74413R_FRAME_SIZE;
+ xfer++;
}

xfer->rx_buf = rx_buf;
--
2.30.2

2022-01-13 21:57:49

by Tanislav, Cosmin

Subject: RE: [PATCH v2] iio: addac: ad74413r: Do not reference negative array offsets

Reviewed-by: Cosmin Tanislav <[email protected]>

> -----Original Message-----
> From: Kees Cook <[email protected]>
> Sent: Wednesday, January 12, 2022 10:35 PM
> To: Lars-Peter Clausen <[email protected]>
> Cc: Kees Cook <[email protected]>; Hennerich, Michael
> <[email protected]>; Jonathan Cameron <[email protected]>;
> [email protected]; Tanislav, Cosmin <[email protected]>;
> Jonathan Cameron <[email protected]>; Linus Walleij
> <[email protected]>; [email protected]; linux-
> [email protected]
> Subject: [PATCH v2] iio: addac: ad74413r: Do not reference negative array
> offsets
>
> [External]
>
> Instead of aiming rx_buf at an invalid array-boundary-crossing location,
> just skip the first increment. Seen when building with -Warray-bounds:
>
> drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode':
> drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below
> array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds]
> 843 | u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> AD74413R_FRAME_SIZE];
> |
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf'
> 84 | u8 rx_buf[AD74413R_FRAME_SIZE *
> AD74413R_CHANNEL_MAX];
> | ^~~~~~
>
> Cc: Lars-Peter Clausen <[email protected]>
> Cc: Michael Hennerich <[email protected]>
> Cc: Jonathan Cameron <[email protected]>
> Cc: [email protected]
> Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
> Reviewed-by: Cosmin Tanislav <[email protected]>
> Signed-off-by: Kees Cook <[email protected]>
> ---
> v1: https://urldefense.com/v3/__https://lore.kernel.org/linux-
> hardening/20220105180214.2435001-1-
> [email protected]/__;!!A3Ni8CS0y2Y!oWs0KcGPANFn-
> L0qJPZgP47AQIYpBXJxg5LHiLDFGa_-SI2DwmSMzjgl3ehyu-8JYPgq$
> v2:
> - Update commit Subject prefix
> - add Reviewed-by
> ---
> drivers/iio/addac/ad74413r.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/iio/addac/ad74413r.c b/drivers/iio/addac/ad74413r.c
> index 5271073bb74e..aba9a643a4ca 100644
> --- a/drivers/iio/addac/ad74413r.c
> +++ b/drivers/iio/addac/ad74413r.c
> @@ -840,7 +840,7 @@ static int ad74413r_update_scan_mode(struct iio_dev
> *indio_dev,
> {
> struct ad74413r_state *st = iio_priv(indio_dev);
> struct spi_transfer *xfer = st->adc_samples_xfer;
> - u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> AD74413R_FRAME_SIZE];
> + u8 *rx_buf = st->adc_samples_buf.rx_buf;
> u8 *tx_buf = st->adc_samples_tx_buf;
> unsigned int channel;
> int ret = -EINVAL;
> @@ -894,9 +894,10 @@ static int ad74413r_update_scan_mode(struct
> iio_dev *indio_dev,
>
> spi_message_add_tail(xfer, &st->adc_samples_msg);
>
> - xfer++;
> tx_buf += AD74413R_FRAME_SIZE;
> - rx_buf += AD74413R_FRAME_SIZE;
> + if (xfer != st->adc_samples_xfer)
> + rx_buf += AD74413R_FRAME_SIZE;
> + xfer++;
> }
>
> xfer->rx_buf = rx_buf;
> --
> 2.30.2

2022-02-01 10:46:52

by Jonathan Cameron

Subject: Re: [PATCH v2] iio: addac: ad74413r: Do not reference negative array offsets

On Thu, 13 Jan 2022 21:57:22 +0000
"Tanislav, Cosmin" <[email protected]> wrote:

> Reviewed-by: Cosmin Tanislav <[email protected]>

Applied to the fixes-togreg branch of iio.git.

Thanks,

Jonathan

>
> > -----Original Message-----
> > From: Kees Cook <[email protected]>
> > Sent: Wednesday, January 12, 2022 10:35 PM
> > To: Lars-Peter Clausen <[email protected]>
> > Cc: Kees Cook <[email protected]>; Hennerich, Michael
> > <[email protected]>; Jonathan Cameron <[email protected]>;
> > [email protected]; Tanislav, Cosmin <[email protected]>;
> > Jonathan Cameron <[email protected]>; Linus Walleij
> > <[email protected]>; [email protected]; linux-
> > [email protected]
> > Subject: [PATCH v2] iio: addac: ad74413r: Do not reference negative array
> > offsets
> >
> > [External]
> >
> > Instead of aiming rx_buf at an invalid array-boundary-crossing location,
> > just skip the first increment. Seen when building with -Warray-bounds:
> >
> > drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode':
> > drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below
> > array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds]
> > 843 | u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> > AD74413R_FRAME_SIZE];
> > |
> > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf'
> > 84 | u8 rx_buf[AD74413R_FRAME_SIZE *
> > AD74413R_CHANNEL_MAX];
> > | ^~~~~~
> >
> > Cc: Lars-Peter Clausen <[email protected]>
> > Cc: Michael Hennerich <[email protected]>
> > Cc: Jonathan Cameron <[email protected]>
> > Cc: [email protected]
> > Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
> > Reviewed-by: Cosmin Tanislav <[email protected]>
> > Signed-off-by: Kees Cook <[email protected]>
> > ---
> > v1: https://urldefense.com/v3/__https://lore.kernel.org/linux-
> > hardening/20220105180214.2435001-1-
> > [email protected]/__;!!A3Ni8CS0y2Y!oWs0KcGPANFn-
> > L0qJPZgP47AQIYpBXJxg5LHiLDFGa_-SI2DwmSMzjgl3ehyu-8JYPgq$
> > v2:
> > - Update commit Subject prefix
> > - add Reviewed-by
> > ---
> > drivers/iio/addac/ad74413r.c | 7 ++++---
> > 1 file changed, 4 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/iio/addac/ad74413r.c b/drivers/iio/addac/ad74413r.c
> > index 5271073bb74e..aba9a643a4ca 100644
> > --- a/drivers/iio/addac/ad74413r.c
> > +++ b/drivers/iio/addac/ad74413r.c
> > @@ -840,7 +840,7 @@ static int ad74413r_update_scan_mode(struct iio_dev
> > *indio_dev,
> > {
> > struct ad74413r_state *st = iio_priv(indio_dev);
> > struct spi_transfer *xfer = st->adc_samples_xfer;
> > - u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> > AD74413R_FRAME_SIZE];
> > + u8 *rx_buf = st->adc_samples_buf.rx_buf;
> > u8 *tx_buf = st->adc_samples_tx_buf;
> > unsigned int channel;
> > int ret = -EINVAL;
> > @@ -894,9 +894,10 @@ static int ad74413r_update_scan_mode(struct
> > iio_dev *indio_dev,
> >
> > spi_message_add_tail(xfer, &st->adc_samples_msg);
> >
> > - xfer++;
> > tx_buf += AD74413R_FRAME_SIZE;
> > - rx_buf += AD74413R_FRAME_SIZE;
> > + if (xfer != st->adc_samples_xfer)
> > + rx_buf += AD74413R_FRAME_SIZE;
> > + xfer++;
> > }
> >
> > xfer->rx_buf = rx_buf;
> > --
> > 2.30.2
>