2019-03-31 18:56:08

by Vincent Stehlé

Subject: [PATCH] iio: adc: ads124: avoid buffer overflow

When initializing the priv->data array starting from index 1, there is one
less element to consider than when initializing the full array.

Fixes: e717f8c6dfec8f76 ("iio: adc: Add the TI ads124s08 ADC code")
Signed-off-by: Vincent Stehlé <[email protected]>
Cc: Dan Murphy <[email protected]>
Cc: Jonathan Cameron <[email protected]>
---
drivers/iio/adc/ti-ads124s08.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/adc/ti-ads124s08.c b/drivers/iio/adc/ti-ads124s08.c
index 53f17e4f2f230..552c2be8d87ad 100644
--- a/drivers/iio/adc/ti-ads124s08.c
+++ b/drivers/iio/adc/ti-ads124s08.c
@@ -202,7 +202,7 @@ static int ads124s_read(struct iio_dev *indio_dev, unsigned int chan)
};

priv->data[0] = ADS124S08_CMD_RDATA;
- memset(&priv->data[1], ADS124S08_CMD_NOP, sizeof(priv->data));
+ memset(&priv->data[1], ADS124S08_CMD_NOP, sizeof(priv->data) - 1);

ret = spi_sync_transfer(priv->spi, t, ARRAY_SIZE(t));
if (ret < 0)
--
2.20.1

2019-04-01 08:34:54

by Mukesh Ojha

Subject: Re: [PATCH] iio: adc: ads124: avoid buffer overflow

On 4/1/2019 12:24 AM, Vincent Stehlé wrote:
> When initializing the priv->data array starting from index 1, there is one
> less element to consider than when initializing the full array.
>
> Fixes: e717f8c6dfec8f76 ("iio: adc: Add the TI ads124s08 ADC code")
> Signed-off-by: Vincent Stehlé <[email protected]>
> Cc: Dan Murphy <[email protected]>
> Cc: Jonathan Cameron <[email protected]>


Reviewed-by: Mukesh Ojha <[email protected]>

Cheers,
-Mukesh

> ---
> drivers/iio/adc/ti-ads124s08.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iio/adc/ti-ads124s08.c b/drivers/iio/adc/ti-ads124s08.c
> index 53f17e4f2f230..552c2be8d87ad 100644
> --- a/drivers/iio/adc/ti-ads124s08.c
> +++ b/drivers/iio/adc/ti-ads124s08.c
> @@ -202,7 +202,7 @@ static int ads124s_read(struct iio_dev *indio_dev, unsigned int chan)
> };
>
> priv->data[0] = ADS124S08_CMD_RDATA;
> - memset(&priv->data[1], ADS124S08_CMD_NOP, sizeof(priv->data));
> + memset(&priv->data[1], ADS124S08_CMD_NOP, sizeof(priv->data) - 1);
>
> ret = spi_sync_transfer(priv->spi, t, ARRAY_SIZE(t));
> if (ret < 0)

2019-04-01 12:43:14

by Dan Murphy

Subject: Re: [PATCH] iio: adc: ads124: avoid buffer overflow

On 3/31/19 1:54 PM, Vincent Stehlé wrote:
> When initializing the priv->data array starting from index 1, there is one
> less element to consider than when initializing the full array.
>
> Fixes: e717f8c6dfec8f76 ("iio: adc: Add the TI ads124s08 ADC code")
> Signed-off-by: Vincent Stehlé <[email protected]>
> Cc: Dan Murphy <[email protected]>
> Cc: Jonathan Cameron <[email protected]>
> ---
> drivers/iio/adc/ti-ads124s08.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iio/adc/ti-ads124s08.c b/drivers/iio/adc/ti-ads124s08.c
> index 53f17e4f2f230..552c2be8d87ad 100644
> --- a/drivers/iio/adc/ti-ads124s08.c
> +++ b/drivers/iio/adc/ti-ads124s08.c
> @@ -202,7 +202,7 @@ static int ads124s_read(struct iio_dev *indio_dev, unsigned int chan)
> };
>
> priv->data[0] = ADS124S08_CMD_RDATA;
> - memset(&priv->data[1], ADS124S08_CMD_NOP, sizeof(priv->data));
> + memset(&priv->data[1], ADS124S08_CMD_NOP, sizeof(priv->data) - 1);
>
> ret = spi_sync_transfer(priv->spi, t, ARRAY_SIZE(t));
> if (ret < 0)
>

Reviewed-by: Dan Murphy <[email protected]>
--
------------------
Dan Murphy

2019-04-07 12:03:45

by Jonathan Cameron

Subject: Re: [PATCH] iio: adc: ads124: avoid buffer overflow

On Mon, 1 Apr 2019 07:41:37 -0500
Dan Murphy <[email protected]> wrote:

> On 3/31/19 1:54 PM, Vincent Stehlé wrote:
> > When initializing the priv->data array starting from index 1, there is one
> > less element to consider than when initializing the full array.
> >
> > Fixes: e717f8c6dfec8f76 ("iio: adc: Add the TI ads124s08 ADC code")
> > Signed-off-by: Vincent Stehlé <[email protected]>
> > Cc: Dan Murphy <[email protected]>
> > Cc: Jonathan Cameron <[email protected]>
> > ---
> > drivers/iio/adc/ti-ads124s08.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/iio/adc/ti-ads124s08.c b/drivers/iio/adc/ti-ads124s08.c
> > index 53f17e4f2f230..552c2be8d87ad 100644
> > --- a/drivers/iio/adc/ti-ads124s08.c
> > +++ b/drivers/iio/adc/ti-ads124s08.c
> > @@ -202,7 +202,7 @@ static int ads124s_read(struct iio_dev *indio_dev, unsigned int chan)
> > };
> >
> > priv->data[0] = ADS124S08_CMD_RDATA;
> > - memset(&priv->data[1], ADS124S08_CMD_NOP, sizeof(priv->data));
> > + memset(&priv->data[1], ADS124S08_CMD_NOP, sizeof(priv->data) - 1);
> >
> > ret = spi_sync_transfer(priv->spi, t, ARRAY_SIZE(t));
> > if (ret < 0)
> >
>
> Reviewed-by: Dan Murphy <[email protected]>

Applied to the fixes-togreg branch of iio.git and pushed out as testing
for the autobuilders to play with it.

Thanks,

Jonathan

2019-04-07 12:04:32

by Jonathan Cameron

Subject: Re: [PATCH] iio: adc: ads124: avoid buffer overflow

On Sun, 7 Apr 2019 13:02:42 +0100
Jonathan Cameron <[email protected]> wrote:

> On Mon, 1 Apr 2019 07:41:37 -0500
> Dan Murphy <[email protected]> wrote:
>
> > On 3/31/19 1:54 PM, Vincent Stehlé wrote:
> > > When initializing the priv->data array starting from index 1, there is one
> > > less element to consider than when initializing the full array.
> > >
> > > Fixes: e717f8c6dfec8f76 ("iio: adc: Add the TI ads124s08 ADC code")
> > > Signed-off-by: Vincent Stehlé <[email protected]>
> > > Cc: Dan Murphy <[email protected]>
> > > Cc: Jonathan Cameron <[email protected]>
> > > ---
> > > drivers/iio/adc/ti-ads124s08.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/iio/adc/ti-ads124s08.c b/drivers/iio/adc/ti-ads124s08.c
> > > index 53f17e4f2f230..552c2be8d87ad 100644
> > > --- a/drivers/iio/adc/ti-ads124s08.c
> > > +++ b/drivers/iio/adc/ti-ads124s08.c
> > > @@ -202,7 +202,7 @@ static int ads124s_read(struct iio_dev *indio_dev, unsigned int chan)
> > > };
> > >
> > > priv->data[0] = ADS124S08_CMD_RDATA;
> > > - memset(&priv->data[1], ADS124S08_CMD_NOP, sizeof(priv->data));
> > > + memset(&priv->data[1], ADS124S08_CMD_NOP, sizeof(priv->data) - 1);
> > >
> > > ret = spi_sync_transfer(priv->spi, t, ARRAY_SIZE(t));
> > > if (ret < 0)
> > >
> >
> > Reviewed-by: Dan Murphy <[email protected]>
>
> Applied to the fixes-togreg branch of iio.git and pushed out as testing
> for the autobuilders to play with it.
Wrong finger memory. Not pushed out as testing. Pushed out as fixes-togreg!

Jonathan
>
> Thanks,
>
> Jonathan