From patchwork Wed Dec 15 23:23:20 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12679697 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA6B8C433FE for ; Wed, 15 Dec 2021 23:23:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231875AbhLOXXY (ORCPT ); Wed, 15 Dec 2021 18:23:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34678 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230214AbhLOXXY (ORCPT ); Wed, 15 Dec 2021 18:23:24 -0500 Received: from mail-pf1-x42c.google.com (mail-pf1-x42c.google.com [IPv6:2607:f8b0:4864:20::42c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EC300C061574 for ; Wed, 15 Dec 2021 15:23:23 -0800 (PST) Received: by mail-pf1-x42c.google.com with SMTP id r130so22071233pfc.1 for ; Wed, 15 Dec 2021 15:23:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=CUP5pV4LbjbL6ChpTJEV6t+0KAeGUNhk4yeQuFtZ/xA=; b=Ws+rXqdD6928Ay/PkMMSzT9wQHS0j5pi/XTU6+k+VIqcxZBLkmWpp5S+Y9esKdsNkk W7ehpnlaeyFNppGMujWC0hLvjEZHmI7k8iO6sce67sw+hJ0VikA0/af6PIjqMYWfIqm9 6TO+YBPwY5vWJ+CV60DZX2tXReWXtwDvUz5jg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=CUP5pV4LbjbL6ChpTJEV6t+0KAeGUNhk4yeQuFtZ/xA=; b=AUXaeqLp3D4yP1U7CwILi73jBSWQpq6+porSl252Fj5ypalvQBLGmVwyNS7u04Wpzy GTn89Kgx20kkK58LgvNKSNqexuvpoov7c3ExeS+7Hvu+roDdn8wxrO8PHGHCkqrsEZf9 QXo9CPDNHv9AP1HkQgyqLWX7vYT4fuFc3eXTxqoEkDbDl/e7Bvsv1N11hSiyaB/7EAoW WLfskW/o99aGrNGIv9wQcCPynhiQxDC/ZiFum090lklLO3pFcRpjNnr1pF/8xHEYfTq+ ODEb/3fLTzQQ9HfJXKUnNMGDQVpP8jdxt1vWjee6LHz6rUJsQMUu9MJTaIH1MaM7pzeB UGpg== X-Gm-Message-State: AOAM530zZ6+yT6KDCtlPExyGQnC+nW6Z+4+qKGjElw0eagCAoWidr9V3 +hzdLG9qA9XtvQ8SjBaGKBGQyQ== X-Google-Smtp-Source: ABdhPJzqO0/IPXNwz2AlY7ytkYuVi/RaN7Jxgnt3LGSyOxd9ozEXsC2NQNtE2BU7fgql2RtkN7zJfA== X-Received: by 2002:a63:db14:: with SMTP id e20mr9656006pgg.177.1639610603355; Wed, 15 Dec 2021 15:23:23 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id l14sm3166142pgj.16.2021.12.15.15.23.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Dec 2021 15:23:23 -0800 (PST) From: Kees Cook To: Lars-Peter Clausen Cc: Kees Cook , Michael Hennerich , Cosmin Tanislav , Jonathan Cameron , Linus Walleij , linux-kernel@vger.kernel.org, linux-iio@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH] iio: addac: Do not reference negative array offsets Date: Wed, 15 Dec 2021 15:23:20 -0800 Message-Id: <20211215232321.2069314-1-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2147; h=from:subject; bh=Ug++7VdcHQcDDwReQr4ZZ2ULLBwyzvNrHrJYpH65vb8=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBhunjokBc4G+Gp61s8YXcf4TMtGIMymQWs9kymrw0s eVyhA6SJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYbp46AAKCRCJcvTf3G3AJoGwD/ 9Hyty00effkGKmBLJYH8X7GwBl/3KmCr8nA4gf+PRO19CR/YrVhsIitp4v+RuqxsMvuRk2h+ZEYfSR +O46ycFY77Adcs1fTLdmHvNrl+swH0cfnnubMkQmc4TFVJQtyrrG8PWi7rIy4Qyj8RNuKiZQljDu8m VJC+uKkRd6oaayIJYWGjNJrlN73qASgk82bdFMo0YtvOPvNZYXngctZ545RpWGf/jh1hLV+mMsM41d CRE7iegJUpPEOHEamFn/pVRAs/aZ6YW1hdo9W/qGY8aYIJu45Dgy+f+Dcg9UU//QCy+HYmukHX9017 yhKssf9r5WQAM0TYWCMhqb3NaRERQBPZ17C+PO1IkSv2GZG6Eg+r/iFa2Ixsi5f6u+KpX2X29K2M+e PlzC92z9DpXHVdeOQ954dP5nVmn12JlrWwC4hieW+y3tibw76MbSBEjiqWBHjf5NtuH2GMG2wtnAa2 kCQe7GCmcUUc5PZFWlcJy5CK4S39C/pgWb5v+n/dHjMBjpnZmqrvz83zkNeNwfyKMxBY/iVIcOjhOx VlJ/zUYaem2f85axHsfd0octFuSXyWTrfrtDql/qror9JBtwoS8A30Zf5t5xvN9+oEkjKFftYeJSyJ m3rUzjl75PgfjPGWt+Qj5BlVWado8vMvbh2X6MYhwdBeboXXOr8H+c7kuCsA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Instead of aiming rx_buf at an invalid array-boundary-crossing location, just skip the first assignment. Seen when building with -Warray-bounds: drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode': drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds] 843 | u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 * AD74413R_FRAME_SIZE]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf' 84 | u8 rx_buf[AD74413R_FRAME_SIZE * AD74413R_CHANNEL_MAX]; | ^~~~~~ Fixes: fea251b6a5db ("iio: addac: add AD74413R driver") Signed-off-by: Kees Cook --- drivers/iio/addac/ad74413r.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/iio/addac/ad74413r.c b/drivers/iio/addac/ad74413r.c index cbd9aa9b399a..b0a6d8ee5133 100644 --- a/drivers/iio/addac/ad74413r.c +++ b/drivers/iio/addac/ad74413r.c @@ -840,7 +840,7 @@ static int ad74413r_update_scan_mode(struct iio_dev *indio_dev, { struct ad74413r_state *st = iio_priv(indio_dev); struct spi_transfer *xfer = st->adc_samples_xfer; - u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 * AD74413R_FRAME_SIZE]; + u8 *rx_buf = st->adc_samples_buf.rx_buf; u8 *tx_buf = st->adc_samples_tx_buf; unsigned int channel; int ret; @@ -877,9 +877,8 @@ static int ad74413r_update_scan_mode(struct iio_dev *indio_dev, if (ret) goto out; - st->adc_active_channels++; - if (xfer == st->adc_samples_xfer) + if (xfer == st->adc_samples_xfer || st->adc_active_channels == 0) xfer->rx_buf = NULL; else xfer->rx_buf = rx_buf; @@ -896,7 +895,10 @@ static int ad74413r_update_scan_mode(struct iio_dev *indio_dev, xfer++; tx_buf += AD74413R_FRAME_SIZE; - rx_buf += AD74413R_FRAME_SIZE; + if (st->adc_active_channels) + rx_buf += AD74413R_FRAME_SIZE; + + st->adc_active_channels++; } xfer->rx_buf = rx_buf;