• Jonathan Cameron's avatar
    iio:accel:mma8452: Fix timestamp alignment and prevent data leak. · 89226a29
    Jonathan Cameron authored
    One of a class of bugs pointed out by Lars in a recent review.
    iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
    to the size of the timestamp (8 bytes).  This is not guaranteed in
    this driver which uses a 16 byte u8 array on the stack.  As Lars also noted
    this anti pattern can involve a leak of data to userspace and that
    indeed can happen here.  We close both issues by moving to
    a suitable structure in the iio_priv() data with alignment
    ensured by use of an explicit c structure.  This data is allocated
    with kzalloc so no data can leak appart from previous readings.
    
    The additional forcing of the 8 byte alignment of the timestamp
    is not strictly necessary but makes the code less fragile by
    making this explicit.
    
    Fixes: c7eeea93 ("iio: Add Freescale MMA8452Q 3-axis accelerometer driver")
    Reported-by: default avatarLars-Peter Clausen <lars@metafoo.de>
    Cc: Peter Meerwald <pmeerw@pmeerw.net>
    Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
    Reviewed-by: default avatarAndy Shevchenko <andy.shevchenko@gmail.com>
    Cc: <Stable@vger.kernel.org>
    89226a29
mma8452.c 46.6 KB