From patchwork Sun Jun 7 15:54:02 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jonathan Cameron X-Patchwork-Id: 11591711 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3EAFF913 for ; Sun, 7 Jun 2020 15:56:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 20A302077D for ; Sun, 7 Jun 2020 15:56:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591545411; bh=bEkx+kdm4FbF7v8rgFy3YdWHwD04eABMX6SAPjuSXqc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=or4eQp/SQ90BHmZ9T9uT4CMgTkhHSWlB1qavecc8sKObhcKdHqnMrescp/iG81igD Rk0BLJEH/CVpV1a9rBHnif3g3ubpyQf389FQqzdwy3ZgRFyKF1LeWpbgwxd646drfd vDDOyCjkccZtPX9FIQmDTiraCksmPMIdEU/Cif6o= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726788AbgFGP4u (ORCPT ); Sun, 7 Jun 2020 11:56:50 -0400 Received: from mail.kernel.org ([198.145.29.99]:57616 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726703AbgFGP4u (ORCPT ); Sun, 7 Jun 2020 11:56:50 -0400 Received: from localhost.localdomain (cpc149474-cmbg20-2-0-cust94.5-4.cable.virginm.net [82.4.196.95]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AF89E2078C; Sun, 7 Jun 2020 15:56:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591545409; bh=bEkx+kdm4FbF7v8rgFy3YdWHwD04eABMX6SAPjuSXqc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vFDld1g0AjWzRM5X0hGbdnrnIre2P0atBrbw/6tmNy7R5G6oS/9SkCWV/5KNrVK+S CnGFRDdIHzHIxJS3/oOnb53EIk62dhpLYxqsWpuNckuYE/+utSeT8mkArVzVgYl2DN P3/JTLXhwKtBO8XdJh1LjniyfLN5FQzJk/CByFCY= From: Jonathan Cameron To: linux-iio@vger.kernel.org Cc: Andy Shevchenko , Jonathan Cameron , Lars-Peter Clausen Subject: [PATCH 26/32] iio:adc:ti-ads1015 Fix buffer element alignment Date: Sun, 7 Jun 2020 16:54:02 +0100 Message-Id: <20200607155408.958437-27-jic23@kernel.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200607155408.958437-1-jic23@kernel.org> References: <20200607155408.958437-1-jic23@kernel.org> MIME-Version: 1.0 Sender: linux-iio-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-iio@vger.kernel.org From: Jonathan Cameron One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. Here we use an explicit structure and rely on that to enforce alignment on the stack. Note there was never a data leak here due to the explicit memset. Explicit alignment of ts is needed to avoid incorrect padding on architectures which only enforce 4 byte alignment for s64 such as x86_32 Fixes: ecc24e72f437 ("iio: adc: Add TI ADS1015 ADC driver support") Reported-by: Lars-Peter Clausen Cc: Andy Shevchenko Signed-off-by: Jonathan Cameron --- drivers/iio/adc/ti-ads1015.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c index 629c631e8f5c..6f4b54b97c5c 100644 --- a/drivers/iio/adc/ti-ads1015.c +++ b/drivers/iio/adc/ti-ads1015.c @@ -385,10 +385,14 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p) struct iio_poll_func *pf = p; struct iio_dev *indio_dev = pf->indio_dev; struct ads1015_data *data = iio_priv(indio_dev); - s16 buf[8]; /* 1x s16 ADC val + 3x s16 padding + 4x s16 timestamp */ + /* Ensure natural alignment for buffer elements */ + struct { + s16 channel; + s64 ts __aligned(8); + } scan; int chan, ret, res; - memset(buf, 0, sizeof(buf)); + memset(&scan, 0, sizeof(scan)); mutex_lock(&data->lock); chan = find_first_bit(indio_dev->active_scan_mask, @@ -399,10 +403,10 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p) goto err; } - buf[0] = res; + scan.channel = res; mutex_unlock(&data->lock); - iio_push_to_buffers_with_timestamp(indio_dev, buf, + iio_push_to_buffers_with_timestamp(indio_dev, &scan, iio_get_time_ns(indio_dev)); err: