• Jonathan Cameron's avatar
    iio:light:si1145: Fix timestamp alignment and prevent data leak. · 0456ecf3
    Jonathan Cameron authored
    One of a class of bugs pointed out by Lars in a recent review.
    iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
    to the size of the timestamp (8 bytes).  This is not guaranteed in
    this driver which uses a 24 byte array of smaller elements on the stack.
    As Lars also noted this anti pattern can involve a leak of data to
    userspace and that indeed can happen here.  We close both issues by
    moving to a suitable array in the iio_priv() data with alignment
    explicitly requested.  This data is allocated with kzalloc so no
    data can leak appart from previous readings.
    
    Depending on the enabled channels, the  location of the timestamp
    can be at various aligned offsets through the buffer.  As such we
    any use of a structure to enforce this alignment would incorrectly
    suggest a single location for the timestamp.  Comments adjusted to
    express this clearly in the code.
    
    Fixes: ac45e57f ("iio: light: Add driver for Silabs si1132, si1141/2/3 and si1145/6/7 ambient light, uv index and proximity sensors")
    Reported-by: default avatarLars-Peter Clausen <lars@metafoo.de>
    Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
    Reviewed-by: default avatarAndy Shevchenko <andy.shevchenko@gmail.com>
    Cc: Peter Meerwald-Stadler <pmeerw@pmeerw.net>
    Cc: <Stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20200722155103.979802-9-jic23@kernel.org
    0456ecf3
si1145.c 34.5 KB